Wasmtime’s runtime allocates WebAssembly tables by performing arithmetic that can overflow when a module or component specifies an extremely large table size under the memory64 proposal. This overflow leads to a panic that abruptly terminates the runtime, causing a loss of service for any application that depends on Wasmtime. The crash does not expose code execution or data exfiltration vulnerabilities.

The affected product is Wasmtime from Bytecode Alliance. Versions prior to 36.0.8, prior to 43.0.2, and prior to 44.0.1 contain the vulnerability. These include releases from 30.0.0 through 36.0.7, as well as 43.0.1 and earlier 44.0.0. The patched releases are 36.0.8, 43.0.2, and 44.0.1.

The CVSS score of 5.9 indicates moderate severity. No EPSS data is available, so the likelihood of exploitation is undefined. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a crafted WebAssembly module or component that requests a table size beyond the 32‑bit limit enabled by the memory64 proposal; such a request would trigger the overflow and cause the runtime to panic, resulting in denial of service.