Wasmtime will incorrectly validate the length of a UTF‑16 string when converting it to the component‑model UTF‑16+latin1 encoding. The check uses the number of code units instead of the byte length, which is twice that size, causing a read beyond the end of a WebAssembly module’s linear memory. In the default configuration the out‑of‑bounds read hits an unmapped guard page, terminating the process with a segmentation fault; when guard pages are disabled the host may read and interpret arbitrary memory, potentially exposing sensitive data.

The affected product is the Wasmtime runtime from bytecodealliance, with all releases before 24.0.7, 36.0.7, 42.0.2, and 43.0.1 vulnerable. These versions are used in edge, container, and integration environments that execute WebAssembly modules.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity, and it is not listed in the CISA KEV catalog. Exploitation requires a malicious or compromised WebAssembly module that includes a UTF‑16 string processed in component‑model mode. The attack vector could be local or remote depending on how the module is supplied. In default configurations the effect is a denial of service through a host crash, while disabling guard pages could also allow inadvertent memory reads exposing protected data.