Wasmtime’s implementation of string transcoding between components fails to validate the memory address returned by a guest component’s realloc function. This flaw allows a malicious guest to cause the host to write arbitrary transcoded string bytes to a location anywhere up to 4 GiB away from the base of linear memory. The resulting out‑of‑bounds write can corrupt host data structures, other guests’ memories, or trigger an unhandled fault that aborts the process. Such corruption or crash can enable arbitrary code execution or lead to denial of service.

The vulnerability affects the Wasmtime runtime provided by Bytecode Alliance. All releases before version 24.0.7, 36.0.7, 42.0.2, and 43.0.1 are impacted. The fix is available in those exact versions and any later maintenance releases.

The CVSS score of 6.1 indicates a medium severity. The exploit relies on a guest WebAssembly component that can invoke the vulnerable reclamation logic, so an attacker must be able to supply and load a malicious component into the Wasmtime host. Hosts configured with the default 4 GiB guest memory and guard pages will typically crash the process, while hosts reducing the reserved memory or disabling guard pages may suffer data corruption, potentially enabling remote code execution. No known public exploits exist and the vulnerability is not listed in the KEV catalog; however organizations running unpatched Wasmtime versions should consider the risk significant due to the potential impact on host integrity.