Wasmtime converts WebAssembly component values into internal Val objects. In releases before 24.0.7, 36.0.7, 42.0.2 and 43.0.1, an attempt to lift a flags‑typed component value that contains bits outside the allowed flag set triggers a panic during the lift process. The panic causes the host runtime to crash, which can be induced by a guest WebAssembly module that supplies a crafted flags value. This failure mode is an unhandled panic, not a silent error, and therefore the host terminates execution, resulting in a denial of service for any service running the affected Wasmtime instance.

The vulnerability affects the Wasmtime runtime from Bytecode Alliance. All releases earlier than 24.0.7 on the 24.x line, earlier than 36.0.7 on the 36.x line, earlier than 42.0.2 on the 42.x line, and earlier than 43.0.1 on the 43.x line are susceptible. Organizations that embed Wasmtime in their applications or infrastructure must verify which version they are using and ensure it is later than the noted patches.

The CVSS score of 5.6 classifies this issue as medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no known widespread exploitation yet. Nevertheless, the flaw can be triggered by any untrusted WebAssembly module supplying a malicious flags‑typed component value, implying that an attacker who controls guest code can induce a host crash. The risk to environments exposed to untrusted code is therefore significant, even though the exploit difficulty and potential for widespread impact are moderate. Updating to a patched release removes this risk.