A bug in Wasmtime’s Winch compiler misinterprets the table.size instruction for 64‑bit tables, returning a 32‑bit value when the correct size is larger. This mismatch allows a WebAssembly guest to read data that resides on the host’s stack, potentially exposing sensitive information that should remain hidden from untrusted guest code. The flaw represents an integer type mismatch weakness (CWE‑681).

Bytecodealliance Wasmtime releases from 25.0.0 up to, but not including, 36.0.7, as well as the versions 42.0.2 and 43.0.1, contain the vulnerability. These releases have been corrected in 36.0.7, 42.0.2, and 43.0.1.

The CVSS score of 2.3 indicates low overall risk. Based on the description, it is inferred that an attacker must be able to execute WebAssembly code within a vulnerable Wasmtime instance to trigger the leak, suggesting a local or controlled code execution scenario rather than a traditional remote attack vector. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, implying limited current exploit activity, but host systems running untrusted Wasm code remain at risk of accidental data disclosure.