The vulnerability allows guest code to execute zero-length component model stream operations with unvalidated addresses. These operations trigger a panic in the Direct{Source,Destination}::remaining logic, causing the host Wasm runtime to crash. The crash results in a denial of service rather than compromising confidentiality or integrity.

Bytecode Alliance Wasmtime versions 46.0.0 through 48.0.5 and 49.0.0 through 49.0.2 are affected. The issue is fixed in Wasmtime 48.0.6 and later, and in 49.0.3 and later.

The CVSS score of 5.9 indicates moderate severity. No EPSS data is publicly available, so the current exploit probability is uncertain; the issue is not listed in the CISA KEV catalog, suggesting it is not a known, actively exploited vulnerability. A likely attack vector involves an attacker running malicious guest code within a Wasmtime host, issuing zero‑length stream reads or writes. Successful exploitation for that scenario results in a crash of the embedding application, denying service to legitimate workloads.