Wasmtime 46.0.0 through 46.0.2 and 47.0.0 through 47.0.3 contain an uncontrolled resource allocation vulnerability in the WASIp3 implementation. A malicious guest can specify arbitrarily large buffers for write streams, causing the host to copy every byte into an internal buffer that grows only as large as the guest’s linear memory. This can exhaust host RAM, leading to crashes or degraded performance. The weakness is categorized as CWE‑770, Uncontrolled Resource Consumption.

The affected product is the bytecodealliance Wasmtime runtime. Versions that are vulnerable include 46.0.0, 46.0.1, 46.0.2 and 47.0.0, 47.0.1, 47.0.2, 47.0.3. Later releases such as 46.0.3+ and 47.0.4+ contain the fix.

The CVSS score of 6.9 places this issue in the Medium severity range. While no EPSS score is available, the vulnerability can be triggered from any guest WebAssembly module that uses WASIp3 write streams, making the attack vector effectively Internet‑accessible for systems that accept untrusted wasm. The lack of KEV listing indicates no known active exploits, but the potential for a denial of service by an attacker who can run malicious wasm remains real.