Wasmtime EUVD-2026-91765

Exploitation requires a non-default embedding: the host must either (1) install a Store::epoch_deadline_callback (or fuel callback) that MUTATES the Store - such as growing linear memory, growing a non-nullable table, or triggering garbage collection - or (2) continue using a Store after a trap or cancellation instead of discarding it. The attacker-controlled guest must then execute a bulk operation (memory.copy, table.grow/fill, or array.copy) and hit the fuel/epoch preemption window during that operation. Limiting factors: embeddings whose callbacks only read host data in Store<T>, and embeddings that discard the Store after timeout/epoch deadline, are explicitly NOT affected; success also depends on winning a race-condition timing window (AC:H/AT:P), and the affected version range is narrow (46.0.0-46.0.1 and 47.0.0-47.0.2).

This is a genuinely low-priority issue despite being a memory-safety/GC-corruption bug, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 base score is 2.0 (Low) with a vector (AV:N/AC:H/AT:P/PR:H/UI:P) that reflects heavy preconditions: high attack complexity, a present attack requirement (AT:P, i.e. a timing/race window), high privileges, and passive user interaction. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so exploitation status is 'no public exploit identified at time of analysis' - not active exploitation. The critical caveat is that this is NOT a flaw in default Wasmtime behavior: it only manifests when an embedder writes callbacks (Store::epoch_deadline_callback) that mutate the Store, or continues using a Store after a trap/cancellation. The advisory explicitly states embeddings that only access host data in Store<T>, and those that discard a Store after timeout/epoch deadline, are unaffected. The headline CWE-362 (race condition) and the DoS tag track the crash/invalid-access outcome, but reaching GC heap corruption requires a specific, non-default embedding pattern plus precise preemption timing. Net: real bug, correctly patched, but low real-world risk - prioritize routine patching, not emergency response.

An embedder configures an epoch-deadline or fuel callback that mutates its Store (e.g. grows linear memory or triggers GC), or keeps using a Store after a trap/cancellation. A malicious guest module invokes a bulk operation such as memory.copy, table.grow, or array.copy and arranges for preemption mid-operation, so the callback-induced mutation invalidates retained raw pointers or GC pointers or leaves null elements in a non-nullable table. No public exploit code was identified; successful abuse also depends on winning the race window (CVSS AC:H/AT:P).