This vulnerability arises when a host creates a component‑model stream or future that is lowered into a guest WebAssembly module. The conversion routine mistakenly omits a required payload‑type check after the value passes through guest code and returns through typed interfaces. An attacker who can influence exported function signatures or returned values can cause the host to deliver a type‑erased value to the guest expecting a different payload, which triggers a panic in the Wasmtime host. The outcome is a crash that may result in denial of service for the host process and any services relying on it.

The issue affects the Wasmtime runtime from the bytecodealliance group, specifically versions 46.0.0 through 48.0.6 and the 49.0.3 release. The vulnerability is resolved in the following releases: Wasmtime 48.0.7 and 49.0.4.

With a CVSS score of 5.7 the risk is considered medium; no EPSS score is published and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the ability to run or influence WebAssembly modules within the Wasmtime host, making the threat most relevant to systems that execute untrusted or partially trusted modules. An attacker could trigger a host crash by manipulating exported function types or return values, potentially denying service to any dependent applications.