This vulnerability in Wasmtime allows a malicious WebAssembly module to trigger a host panic by taking advantage of an improper reset of the may_leave flag during a memory realloc. The flaw causes the host to crash when a Wasm module re-enters the host from a realloc operation while lowering stream or future results, such as canceling an active read or re‑waiting a waitable set. The result is a loss of service for any application that loads untrusted modules, as the host process terminates abruptly.

The flaw affects the Bytecode Alliance Wasmtime runtime in versions 46.0.0 up to and including 47.x, as well as 48.0.0 through 48.0.5 and 49.0.0 through 49.0.2. Versions 48.0.6 and later, and 49.0.3 and later, contain the fix.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, suggesting limited public data on exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the flaw could allow an attacker to cause a host panic by delivering a malicious WebAssembly module that takes advantage of the mismanaged may_leave flag during realloc. This inference assumes that the application loads untrusted Wasm modules; the actual attack vector is not explicitly stated in the advisories, so the possibility of remote or high‑privilege exploitation is drawn from the potential to supply arbitrary modules.