A guest WebAssembly program can send timestamp values to the host with a sub‑second component that overflows the seconds field. This integer overflow (CWE‑190) triggers a panic in Wasmtime when the host processes file‑timestamp update calls, causing the host process to crash and result in a denial of service. The vulnerability does not compromise confidentiality or integrity, but it can disrupt availability of services that rely on the stable operation of the Wasmtime runtime.

The affected product is Bytecode Alliance's Wasmtime. Versions before 36.0.16, before 48.0.3 (for version 37.0.0 series), and before 49.0.1 (for version 49.0.0 series) are vulnerable. All later releases have the overflow check removed and are not affected.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, so the likelihood of exploitation is uncertain, but the nature of the attack—requiring a crafted WASI program—suggests that an attacker would need to control the input of the guest module. The vulnerability is not listed in the CISA KEV catalog. Exploitation leads to a host crash but does not directly allow code execution or data disclosure. The attack vector is inferred to be a trusted or compromised guest module that can supply malicious timestamp values to the host's file‑system functions.