Wasmtime versions 46.0.0 through 48.0.5 and 49.0.0 through 49.0.2 contain a denial‑of‑service flaw that allows an attacker to cause the host process to panic. By supplying a WebAssembly component whose start function performs an asynchronous import lowered via thread.yield, the unhandled fiber drop crashes the embedding application. The weakness is classified as CWE‑372, representing a logic error that leads to a denial of service.

Affected products are the Wasmtime runtime from Bytecodealliance. Vulnerable releases are Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3. All earlier or later patches are considered safe.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in KEV, suggesting it is not currently widely exploited. Exploitation requires an attacker who can supply or influence the WebAssembly component loaded by a host. The host must execute the malicious start function, implying local or privileged execution context rather than a remote, unauthenticated vector.