Wasmtime releases up to 47.x, 48.0.0 to 48.0.3, and 49.0.0 to 49.0.1 contain a stack buffer overflow that is triggered by passing malformed async callback result types from a guest module. This vulnerability is a CWE-20: Improper Input Validation and a CWE-787: Out‑of‑bounds Write. An attacker can craft an async callback with an incorrect type signature, causing the host to write roughly 16 KB of data onto its native stack. This corrupts return addresses, which an attacker can use to cause a host crash or to redirect execution flow, thereby potentially escaping the sandbox or executing arbitrary native code on the host system.

All bytecodealliance Wasmtime releases 39.0.0 through 47.x, 48.0.0 through 48.0.3, and 49.0.0 through 49.0.1 are vulnerable. The vulnerability is mitigated in Wasmtime 48.0.4, 49.0.2, and later releases.

The CVSS v3.1 score of 9.4 indicates a high‑severity flaw. The EPSS score is below 1%, indicating a very low probability of exploitation in the current environment, and it is not listed in the CISA KEV catalog. The attack vector requires a malicious guest component; therefore it is most relevant in deployments that run untrusted WebAssembly code. Once the overflow is triggered, the attacker can crash the host or execute arbitrary native code, giving full control over the host process.