The vulnerability in Wasmtime versions 46.0.0 through 48.0.5 and 49.0.0 through 49.0.2 leads to a denial of service when a guest WebAssembly module triggers a trap that poisons the Store. The poisoned Store causes pending calls to proceed, resulting in an assertion failure that crashes the host process. Attackers who can supply misbehaving guest code can trigger this behavior.

The vendor affected is bytecodealliance:wasmtime. The software versions impacted are Wasmtime 46.0.0 up to 48.0.5 inclusive and Wasmtime 49.0.0 up to 49.0.2 inclusive.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to load custom guest code into the Wasmtime runtime, which is typically a local or trusted privilege in an embedded environment. The vulnerability can surface when an untrusted module is executed, leading to an inconsistent Store state and eventual host crash.