Bytecode Alliance WebAssembly Micro Runtime up to 2.4.4 Two-Pass Fast Interpreter Loader wasm_loader.c wasm_loader_get_const_offset heap-based overflow

Summaryinfo

A vulnerability described as problematic has been identified in Bytecode Alliance WebAssembly Micro Runtime up to 2.4.4. Affected is the function wasm_loader_get_const_offset of the file core/iwasm/interpreter/wasm_loader.c of the component Two-Pass Fast Interpreter Loader. The manipulation results in heap-based overflow. This vulnerability is reported as CVE-2026-54912. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Bytecode Alliance WebAssembly Micro Runtime up to 2.4.4. Affected is the function wasm_loader_get_const_offset of the file core/iwasm/interpreter/wasm_loader.c of the component Two-Pass Fast Interpreter Loader. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on integrity, and availability. CVE summarizes:

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants inflate the first pass beyond the constant-slot limit, wasm_loader_get_const_offset emits later constants inline, but the between-pass sort and deduplication reduces the table so the second pass can choose table references and cause reserve_block_ret to emit additional copy operands that were not included in code_compiled_peak_size. A crafted module can therefore make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation during wasm_runtime_load, before guest code executes. This can corrupt host heap metadata and deterministically crash the process, causing denial of service; further consequences depend on the host application's heap layout. Builds using WAMR_BUILD_FAST_INTERP=1 are affected; disabling the fast interpreter avoids the vulnerable loader. This issue is fixed in version 2.4.5.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-54912 since 06/16/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 2.4.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Bytecode Alliance

Name

• WebAssembly Micro Runtime

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion