A flaw in Wasmtime’s native WASIp1 fd_renumber guest renumbers a descriptor, since the host’s descriptor table is not closed. This flaw represents a resource leak (CWE‑400) and an improper resource shutdown (CWE‑772). The defect behaves normally from the guest’s viewpoint but leaks host resources, eventually exhausting file descriptors and other system handles. The impact is a resource exhaustion that can degrade or halt host process operation.

The issue affects bytecodealliance:wasmtime runtimes installed before 24.0.10, between 25.0.0 and before 36.0.11, between 37.0.0 and before 44.0.3, and the 45.0.0 and 45.0.1 releases. The native WASIp1 implementation is impacted, and the flaw is exploitable only when the runtime loads core WebAssembly modules and publishes the fd_renumber API along with access to file descriptors. Runtimes that deny access to files remain safe.

The CVSS score of 2.3 indicates a low overall severity, and an EPSS score of <1% suggests limited publicly known exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves a malicious guest WebAssembly program that invokes fd_renumber repeatedly while the runtime exposes file descriptors. No known public exploitation exists. The risk depends on whether such guest code can run in theof‑service if the attacker can iterate fd_renumber in a loop.