Wasmtime before versions 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 fails to account for host memory allocations when guest values are lifted through the dynamic Val API, allowing a malicious WebAssembly module to request host allocations far exceeding the tracked quota and bypass the hostcall fuel limit. This flaw leads to excessive consumption of host memory, ultimately causing a denial of service to the Wasmtime process and potentially the host system.

The vulnerability affects the Wasmtime runtime distributed by bytecodealliance. Versions earlier than 36.0.16, earlier than 48.0.3, and earlier than 49.0.1 are impacted. All other recent versions are considered fixed.

The CVSS score of 1 indicates a low severity impact, and no exploit probability is reported. The flaw is listed as not being in the CISA KEV catalog. While a specific attack path is not detailed in the advisory, it can be inferred that the attack vector would involve running a crafted WebAssembly module inside an environment that hosts Wasmtime. An attacker would need to supply a malicious module that triggers the excessive allocation, so the exploitability is primarily limited to contexts that permit arbitrary guest code execution. Given the low CVSS score and lack of known public exploits, the overall risk to deployments remains low but should be mitigated promptly.