Wasmtime releases up to 47.x, 48.0.0 to 48.0.3, and 49.0.0 to 49.0.1 contain a stack buffer overflow that is triggered by passing malformed async callback result types from a guest module. This vulnerability is a CWE-20: Improper Input Validation (Buffer Overflow). An attacker can craft an async callback with an incorrect type signature, causing the host to write roughly 16 KB of data onto its native stack. This corrupts return addresses, which an attacker can use to cause a host crash or to redirect execution flow, thereby potentially escaping the sandbox or executing arbitrary native code on the host system.

All bytecodealliance Wasmtime releases 39.0.0 through 47.x, 48.0.0 through 48.0.3, and 49.0.0 through 49.0.1 are vulnerable. The vulnerability is mitigated in Wasmtime 48.0.4, 49.0.2, and later releases.

The CVSS v3.1 score of 9.4 indicates a high‑severity flaw. No EPSS data is available, but the lack of attribution in the KEV list suggests it is not yet confirmed as widely exploited. The attack vector requires a malicious guest component; therefore it is most relevant in deployments that run untrusted WebAssembly code. Once the overflow is triggered, the attacker can crash the host or execute arbitrary native code, giving full control over the host process.