The flaw is a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. When an embedder invokes an async‑lifted export through Func::call, the assertion fails and the host process panics, causing a crash. This represents a classic unchecked return value weakness leading to a denial of service.

The vulnerability affects Bytecode Alliance’s Wasmtime component runtime, specifically versions 46.0.0 through 47.x, 48.0.0 through 48.0.5, and 49.0.0 through 49.0.2. Any deployment using a component that contains an async‑lifted export in these releases is at risk.

The CVSS base score of 5.9 indicates moderate severity. No EPSS data is available and the issue is not listed in the CISA KEV catalogue, suggesting limited public exploitation. Likely attack requires the attacker to supply a component with an async‑lifted export and trigger Func::call, so exploitation is confined to environments that load user‑supplied components.