Wasmtime's allocation logic for WebAssembly tables used checked arithmetic that panics on overflow. With the WebAssembly memory64 proposal allowing table sizes in the 64-bit range, it is possible to trigger an overflow panic by allocating an extremely large table. This affects Wasmtime versions from 30.0.0 up to but excluding 36.0.8, 43.0.2, and 44.0.1. The vulnerability is identified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-190 (Integer Overflow). The panic occurs during instantiation of WebAssembly modules or components with very large tables, potentially causing denial of service. The vulnerability is fixed in versions 36.0.8, 43.0.2, and 44.0.1. Red Hat advisories reference this CVE in relation to Hardened Images RPMs updates but do not explicitly confirm a direct patch for wasmtime itself.

The vulnerability can cause Wasmtime to panic when allocating very large WebAssembly tables, leading to denial of service conditions during module or component instantiation. There is no indication of code execution or data corruption. The CVSS 4.0 score is 5.9 (medium severity), reflecting network attack vector, low attack complexity, partial privileges required, user interaction needed, and high impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in Wasmtime versions 36.0.8, 43.0.2, and 44.0.1. Users should upgrade to one of these fixed versions to remediate the issue. Red Hat has issued advisories referencing this CVE in Hardened Images RPMs updates; users of Red Hat products should follow Red Hat's update instructions. No alternative mitigations or workarounds are specified in the vendor advisory.