CVE-2025-64704

In WebAssembly Micro Runtime (WAMR) prior to 2.4.5, wasi_poll_oneoff validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can cause a write past the validated Wasm linear-memory boundary into adjacent host heap memory, crashing the host process and potentially affecting confidentiality or integrity depending on heap layout.

WebAssembly Micro Runtime (WAMR) prior to 2.4.5, load_init_expr accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the WASMValue cur_value union is not zero-initialized. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing uninitialized host-stack bytes to be copied into a guest-readable value.

In WebAssembly Micro Runtime (WAMR) prior to 2.4.5, the two-pass fast interpreter loader in wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. A crafted module can make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation, corrupting host heap metadata and deterministically crashing the process.

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading, involving the frame_ref_bottom and frame_offset_bottom arrays. It has been patched in version 2.4.4.