Wasmtime, a WebAssembly runtime, contains a bug that causes the host to panic when transcoding misaligned UTF‑16 strings. The panic occurs because the implementation does not verify the alignment of reallocated strings before passing them to the host. Triggering this panic results in a denial‑of‑service condition, as the host will terminate or restart a component. The weakness is identified as out‑of‑bounds handling and misinterpretation of pointer alignment (CWE‑129 and CWE‑823).

The vulnerability affects the bytecodealliance:wasmtime product. It is present in releases prior to 24.0.7, 36.0.7, 42.0.2 and 43.0.1. Users running any unsupported Wasmtime version that has not applied one of these fixes are at risk.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently confirmed widespread exploitation. The attack vector is inferred to be from a malicious guest component, which can supply specially crafted strings across Wasmtime components to force the host panic, thereby causing a denial‑of‑service. The required attacker capability is the ability to execute guest code within Wasmtime, which is typically local to the host environment.