CVE-2026-54913
MediumCVSS 6.9Summary
WebAssembly Micro Runtime (WAMR) prior to 2.4.5, load_init_expr accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the WASMValue cur_value union is not zero-initialized. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing uninitialized host-stack bytes to be copied into a guest-readable value.
Risk Assessment
An attacker can disclose uninitialized host stack data (4 or up to 12 bytes per global), potentially leading to information leakage. The classic and fast interpreters are affected in the default no-GC configuration.
Recommendation
Update WAMR to version 2.4.5 or later. If updating is not possible, consider enabling GC or avoid running untrusted Wasm modules.
Other vulnerabilities in WebAssembly Micro Runtime (WAMR)
See all- CVE-2026-54914High
In WebAssembly Micro Runtime (WAMR) prior to 2.4.5, wasi_poll_oneoff validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can cause a write past the validated Wasm linear-memory boundary into adjacent host heap memory, crashing the host process and potentially affecting confidentiality or integrity depending on heap layout.
- CVE-2026-54912High
In WebAssembly Micro Runtime (WAMR) prior to 2.4.5, the two-pass fast interpreter loader in wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. A crafted module can make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation, corrupting host heap metadata and deterministically crashing the process.
- CVE-2025-64713Medium
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading, involving the frame_ref_bottom and frame_offset_bottom arrays. It has been patched in version 2.4.4.
- CVE-2025-64704Medium
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentation fault in the v128.store instruction. This issue has been patched in version 2.4.4.
Original NVD description (English source)
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS