Wasmtime versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 have insufficient checks in the Store component when mixing asynchronous and synchronous WebAssembly calls. This flaw allows embedders that re-enter WebAssembly via synchronous APIs from asynchronously called host functions to cause runtime panics or unsound cross-thread movement of non-Send host variables.