Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. An attacker can supply a malicious Wasm module whose callee triggers a garbage collection while the module’s references remain stale or dangling, causing heap corruption or incorrect execution. This flaw can corrupt internal data structures and, if the corruption leads to a code execution path, could result in arbitrary code or denial of service. The vulnerability is non‑persistent and requires that the attacker control the Wasm content loaded by a target application.

Bytecodealliance Wasmtime versions 47.0.0 through 48.0.3 inclusive, and 49.0.0 through 49.0.1 inclusive are affected. These releases do not properly root references during try_call, exposing them to garbage collection.

The CVSS score of 6.9 indicates a medium severity and the EPSS score is not available, meaning a quantified exploitation probability is unknown at this time. The flaw is not currently listed in the CISA KEV catalog. Attackers would need to supply a malicious Wasm module to an application that uses Wasmtime and invokes try_call; the weakness is an improper handling of memory references (CWE‑416) and insufficient rooting of objects (CWE‑825). While no public exploit has been reported, the vulnerability could lead to process compromise if an attacker supplies crafted Wasm code to a target system that loads untrusted modules.