The vulnerability lies in Wasmtime's handling of WebAssembly tags during garbage collection. An attacker with the ability to supply a guest module can mis-type exception object payloads, causing the GC heap to become corrupted. The result is a panic in the Wasmtime runtime when the exceptions proposal is enabled, leading to a crash. The weakness falls under improper validation and type confusion, as identified by CWE-1287 and CWE-843. The primary impact is a denial of service, as the corrupted runtime cannot continue executing modules.

This flaw affects the 47.x release line of Wasmtime before 48.0.4 and the 49.x release line before 49.0.2. The affected vendor is Bytecodealliance, specifically the Wasmtime runtime. Systems running these versions in an environment that loads untrusted guest modules are vulnerable.

The CVSS score of 5.9 suggests moderate severity, and no EPSS score is available, implying limited publicly known exploitation attempts. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to deploy malicious WebAssembly modules that import tags with a subtype of an original type; thus exploitation requires control over the guest payload. In environments where the exceptions proposal is enabled, a single malicious module could trigger the heap corruption and crash, denying service to other modules.