Wasmtime, a WebAssembly runtime by bytecodealliance, contains an out-of-bounds write vulnerability (CWE-787) in its string transcoding between components. The flaw occurs because the host does not validate the guest component's realloc return pointer before writing transcoded string bytes. This allows a guest to cause the host to write data up to 4GiB away from the guest's linear memory base. By default, Wasmtime reserves 4GiB of virtual memory for guest linear memory, causing out-of-bounds writes to hit unmapped memory and abort the host process. However, configurations with less reserved memory and no guard pages may allow corruption of host data structures or other guests' memory. The vulnerability affects Wasmtime versions before 24.0.7, between 25.0.0 and 36.0.7, between 37.0.0 and 42.0.2, and between 43.0.0 and 44.0.1. Fixed versions are 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Exploitation can cause the host process running Wasmtime to abort due to unhandled memory faults or, under certain configurations, lead to corruption of host data structures or other guests' linear memories. This can impact the stability and security of the host environment running Wasmtime. The CVSS 4.0 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on availability.

Fixed versions of Wasmtime are available: 24.0.7, 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to one of these versions to remediate the vulnerability. Patch status is not explicitly confirmed beyond the identification of fixed versions; therefore, users should consult the official bytecodealliance Wasmtime advisories for the latest remediation guidance. No alternative mitigations are indicated.