CVE-2026-27195 is a vulnerability in the Wasmtime WebAssembly runtime introduced with the default enablement of the component-model-async feature starting in version 39.0.0. This feature introduced a new implementation of the asynchronous function call interface, [Typed]Func::call_async, which allows host embeddings to invoke async-typed guest export functions. The vulnerability occurs when the host calls call_async on a component-exported function and polls the returned Future once, then the guest function yields control to the async runtime (e.g., Tokio) either due to an async host function call or epoch interruption. If the host then drops the Future without awaiting its completion and subsequently calls call_async again on the same component instance, the component enters a non-reenterable state. The second call traps but still allocates a task and thread. When the host ignores the trap and drops the Future again, Wasmtime panics because it attempts to dispose of a task whose thread has not exited, causing a runtime panic. This improper handling of exceptional conditions (CWE-755) can lead to a denial-of-service via host application crashes. The vulnerability affects Wasmtime versions >=39.0.0 and <40.0.4, and >=41.0.0 and <41.0.4. Versions 40.0.4, 41.0.4, and later have patched this issue. Workarounds include disabling the component-model-async Cargo feature if unused or ensuring all call_async Futures are awaited until completion, or refraining from reusing the Store after dropping unresolved Futures. The vulnerability requires low privileges but user interaction and careful timing to trigger. No known exploits have been reported in the wild.

The primary impact of CVE-2026-27195 is denial-of-service caused by runtime panics in host applications embedding Wasmtime with the component-model-async feature enabled. This can lead to application crashes, potentially disrupting services that rely on WebAssembly components for execution. Since Wasmtime is used in cloud-native environments, edge computing, and serverless platforms, affected applications may experience instability or downtime. The vulnerability does not directly lead to code execution or data leakage but can degrade system availability and reliability. Organizations embedding Wasmtime in critical infrastructure or high-availability systems may face operational disruptions. The requirement for dropping unresolved Futures and reusing the Store means that only certain usage patterns are vulnerable, limiting the scope but still posing a risk to developers unaware of the issue. The medium CVSS score (6.9) reflects moderate impact with some exploitation complexity. No known active exploitation reduces immediate risk but patching is recommended to prevent future attacks.

1. Upgrade Wasmtime to version 40.0.4, 41.0.4, or later where the vulnerability is patched. 2. If the component-model-async feature is not used, disable it at compile time via Cargo features to avoid exposure. 3. Ensure that all asynchronous calls made via [Typed]Func::call_async are awaited to completion before dropping their Futures. 4. Avoid reusing the same Store instance after dropping a not-yet-resolved call_async Future to prevent entering a non-reenterable state. 5. Implement robust error handling around async calls to detect and recover from panics or traps gracefully. 6. Conduct code reviews and static analysis focusing on async call patterns in Wasmtime embeddings. 7. Monitor application logs for unexpected panics or crashes related to async WebAssembly calls. 8. Educate developers on proper async usage patterns with Wasmtime to prevent misuse. 9. Consider isolating Wasmtime components in separate processes or containers to limit impact of crashes. 10. Stay updated with bytecodealliance advisories for any further patches or mitigations.