The bug causes Wasmtime to panic when an embedding calls an async guest export, polls the returned future, then drops it before it resolves, and subsequently makes another async call using that component instance. Because the component has entered a non‑reenterable state, the second call traps, and the interim task thread is not yet terminated, leading to a panic during cleanup. This results in the host process crashing, which effectively denies service for any application embedding Wasmtime.

The vulnerability affects all binary releases of Wasmtime starting with version 39.0.0 up to, but excluding, the patched releases 40.0.4, 41.0.4 and any later releases such as 42.0.0+, where the component-model-async feature defaults to its fixed implementation. Embeddings compiled without the component-model-async feature, or those that never invoke async component exports, are not impacted. The affected product is the Wasmtime runtime provided by Bytecode Alliance.

The CVSS score is 6.9, reflecting moderate severity, and the EPSS score is below 1%, indicating a very low probability that the flaw will be exploited in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an embedding that performs a call_async on a component-exported function, polls once, drops the future, then reuses the component instance to make another call, and continues to ignore the trapping error. Because this pattern is non‑obvious and likely internal to the embedding application, the attack surface is limited, but a software developer who writes or maintains the Wasmtime host code could trigger it unintentionally, leading to a denial‑of‑service condition.