In Wasmtime 43.0.0 a host‑side error in the linker cloning API can trigger a use‑after‑free. When a program clones a wasmtime::Linker, later drops the original instance, and continues to use the cloned instance, the runtime accesses memory that has already been released, causing unpredictable behavior such as crashes or memory corruption. The flaw cannot be activated by guest WebAssembly code; the attack vector requires specific host API calls.

The affected product is the Wasmtime runtime supplied by Bytecodealliance, version 43.0.0. Any application that embeds this release and performs the clone‑then‑drop sequence – for example, servers, virtual machine managers, or embedded runtimes – may be vulnerable. Version 43.0.1 and later contain the fix.

The CVSS score is 1, indicating a low severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Because the flaw is triggered solely by host code under a very specific API sequence, remote exploitation is unlikely, though a compromised or malicious host could still experience instability or denial of service.