CVE-2026-54912
HighCVSS 8.8Summary
In WebAssembly Micro Runtime (WAMR) prior to 2.4.5, the two-pass fast interpreter loader in wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. A crafted module can make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation, corrupting host heap metadata and deterministically crashing the process.
Risk Assessment
The vulnerability lets a malicious module corrupt host heap metadata and deterministically crash the process (denial of service), with further impact depending on the host application's heap layout. Builds using WAMR_BUILD_FAST_INTERP=1 are affected.
Recommendation
Update WAMR to version 2.4.5 or later. As a workaround, disable the fast interpreter (WAMR_BUILD_FAST_INTERP) to avoid the vulnerable loader.
Other vulnerabilities in WebAssembly Micro Runtime (WAMR)
See all- CVE-2026-54914High
In WebAssembly Micro Runtime (WAMR) prior to 2.4.5, wasi_poll_oneoff validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can cause a write past the validated Wasm linear-memory boundary into adjacent host heap memory, crashing the host process and potentially affecting confidentiality or integrity depending on heap layout.
- CVE-2026-54913Medium
WebAssembly Micro Runtime (WAMR) prior to 2.4.5, load_init_expr accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the WASMValue cur_value union is not zero-initialized. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing uninitialized host-stack bytes to be copied into a guest-readable value.
- CVE-2025-64713Medium
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading, involving the frame_ref_bottom and frame_offset_bottom arrays. It has been patched in version 2.4.4.
- CVE-2025-64704Medium
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentation fault in the v128.store instruction. This issue has been patched in version 2.4.4.
Original NVD description (English source)
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants inflate the first pass beyond the constant-slot limit, wasm_loader_get_const_offset emits later constants inline, but the between-pass sort and deduplication reduces the table so the second pass can choose table references and cause reserve_block_ret to emit additional copy operands that were not included in code_compiled_peak_size. A crafted module can therefore make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation during wasm_runtime_load, before guest code executes. This can corrupt host heap metadata and deterministically crash the process, causing denial of service; further consequences depend on the host application's heap layout. Builds using WAMR_BUILD_FAST_INTERP=1 are affected; disabling the fast interpreter avoids the vulnerable loader. This issue is fixed in version 2.4.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS