The vulnerability arises from insufficient validation in Wasmtime’s Store component when both asynchronous and synchronous WebAssembly calls coexist. When an asynchronous host function triggers a synchronous WebAssembly invocation, the runtime can panic or move non‑Send host data across threads unsafely, leading to a crash or potential memory safety violations that expose the host application to denial of service or data corruption (CWE‑1265).

Bytecode Alliance’s Wasmtime up to but not including version 48.0.6 (i.e., 42.0.0 through 48.0.5) and up to but not including version 49.0.3 (i.e., 49.0.0 through 49.0.2) are affected; the issue is fixed in Wasmtime 48.0.6 and 49.0.3 or later.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker who can influence a Wasmtime instance that mixes async and sync calls; by triggering an async host function that re‑enters the runtime via a sync API, an attacker could cause a panic or unsafe cross‑thread movement of host data. While no public exploit exists, the potential for denial of service and memory corruption warrants prompt remedial action.