Wasmtime, a WebAssembly runtime, contains a bug in its Winch compiler backend that causes the table.grow operator to return a value incorrectly typed as 64‑bit instead of 32‑bit for 32‑bit tables. This mis‑typed value creates an invalid internal state that may lead the host to read or write up to 16 bytes of memory preceding the linear memory region. Because Wasmtime’s default configuration places unmapped guard pages before linear memory, the bug usually aborts the process, resulting in a denial‑of‑service and a potential leak of limited host memory. The vulnerability exists in releases from 25.0.0 through just before 36.0.7, and in earlier 42 and 43 series releases before 42.0.2 and 43.0.1.

Bytecodealliance’s Wasmtime runtime is affected. Vulnerable releases include versions from 25.0.0 up to 35.x, earlier 42 releases before 42.0.2, and earlier 43 releases before 43.0.1. The bug is fixed in Wasmtime 36.0.7, 42.0.2, and 43.0.1 or later.

The CVSS base score for this issue is 6.1, indicating moderate severity. The lack of a publicly available EPSS score and its absence from the CISA Known Exploited Vulnerabilities catalog reduce the perceived risk profile. However, exploitation requires the victim to run WebAssembly code compiled with the Winch backend and to either omit the default guard pages that precede linear memory or to disable them. Because the exploit depends on a specific compiler backend state, it is less likely to succeed against a properly configured deployment but still represents a non‑negligible Denial‑of‑Service risk.