Wasmtime EUVD-2026-113207

Exploitation requires the embedding application to instantiate arbitrary or otherwise untrusted Wasmtime components - the advisory explicitly scopes impact to 'embedder code which instantiates arbitrary components'. The malicious component's start function must call an async-lowered import followed by the thread.yield intrinsic, which triggers the undisposed-fiber drop and host panic. Affected versions are 46.0.0 through 48.0.5 and 49.0.0 through 49.0.2. Limiting factors: embedders that only run trusted/first-party components are not meaningfully exposed; the attacker needs the ability to supply a component (PR:L), the trigger requires a specific async-import-then-yield sequence (reflected in AC:H/AT:P), and impact is confined to crashing the host (availability only, no code execution or data exposure).

This is a medium-severity (CVSS 4.0 base 5.9) availability-only denial-of-service issue, and the decision signals agree it is not an emergency: the vuln.today priority is 'this_month', there is no CISA KEV listing, no EPSS score was supplied, and no public exploit code is referenced. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P, impact VA:H only, VC:N/VI:N) describes a network-reachable but high-barrier condition: high attack complexity, a present attack requirement (AT:P), some privilege (PR:L), and passive user interaction (UI:P), with impact limited strictly to host availability (a panic/crash) - no confidentiality or integrity loss. The real-world exposure is narrow and conditional: only embedders that instantiate attacker-controlled (arbitrary) components are affected, per the vendor advisory. There is no conflict between signals here - all point to a genuine but contained crash risk rather than a widespread, easily-weaponized flaw. The main missing data points are EPSS (not provided) and any independent exploitation telemetry; absence of these is not itself evidence of safety, but nothing in the input indicates active exploitation.

An application embeds Wasmtime and instantiates untrusted WebAssembly components. An attacker submits a component whose start function first calls an async-lowered import and then invokes the thread.yield intrinsic; the runtime becomes confused about the guest thread's state, drops an internal fiber without disposing it, and the host process panics and crashes. No public exploit code is referenced, though the mechanism is described in detail in the Bytecode Alliance advisory.