Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future
Date: 2026-02
Affected: rust/wasmtime, rust/wasmtime
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-27195
CWE: CWE-755

The affected versions of Wasmtime can panic if the host embedder drops the future returned by `wasmtime::component::[Typed]Func::call_async` before it resolves. ### Details Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new implementation of `[Typed]Func::call_async` which made it capable of calling async-typed guest export functions. However, that implementation had a bug leading to a panic under certain circumstances: 1. The host embedding calls `[Typed]Func::call_async` on a function exported by a component, polling the returned `Future` once. 2. The component function yields control to the async runtime (e.g. Tokio), e.g. due to a call to host function registered using `LinkerInstance::func_wrap_async` which yields, or due an epoch interruption. 3. The host embedding drops the `Future` after polling it once. This leaves the component instance in a non-reenterable state since the call never had a chance to complete. 4. The host embedding calls `[Typed]Func::call_async` again, polling the returned `Future`. Since the component instance cannot be entered at this point, the call traps, but not before allocating a task and thread for the call. 5. The host embedding ignores the trap and drops the `Future`. This panics due to the runtime attempting to dispose of the task created above, which panics since the thread has not yet exited. ### Impact When a host embedder using the affected versions of Wasmtime ca


Mitigations:

Architectural layers (MAESTRO):