Wasmtime versions 46.0.0 up to 48.0.3 and 49.0.0 up to 49.0.1 contain a denial‑of‑service flaw in the WASIp3 implementation that can terminate the host process. A guest module that has a mutable preopened directory can invoke the set‑times or set‑times‑at system calls with a negative seconds timestamp, causing an assertion failure inside Wasmtime and crashing the host. The primary consequence is a loss of service of the host application, with potential disruption to all work running under the same process.

The affected product is Wasmtime from Bytecodealliance. Vulnerable releases include 46.0.0 through 48.0.3 and 49.0.0 through 49.0.1. No other vendors or products are listed.

The CVSS score is 6.9, indicating a moderate severity. No EPSS value is available, and the vulnerability is not listed in CISA KEV. An attacker would need the ability to run a WebAssembly module inside the Wasmtime process and to grant it mutable preopened directory access. The exploitation of the flaw is local to the host process and does not require external network connectivity. The attack is therefore inferred to be a local privilege escalation within the Wasmtime sandbox. Due to the assertion‑driven crash, the impact is a definitive denial of service for the host process.