Wasmtime’s runtime allocates WebAssembly tables by performing arithmetic that can overflow when a module or component specifies an extremely large table size under the memory64 proposal. This overflow triggers a panic that aborts the runtime, abruptly terminating any service that depends on Wasmtime. The flaw does not provide an attacker with code execution or data exfiltration capabilities, but it can be used to cause a denial‑of‑service condition.

The vulnerable product is the Wasmtime runtime from Bytecode Alliance. Versions from 30.0.0 through 36.0.7, as well as 43.0.0 through 43.0.1 and 44.0.0, contain the unchecked arithmetic that can overflow. The fix is delivered in releases 36.0.8, 43.0.2, and 44.0.1, which handle table allocation safely.

The CVSS score of 5.9 classifies the issue as moderate severity. EPSS is reported as less than 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted WebAssembly module or component that requests a table size larger than the 32‑bit limit enabled by the memory64 extension; such a request would cause the overflow and a runtime panic, leading to service interruption.