Bytecode Alliance WebAssembly Micro Runtime up to 2.4.4 Wasm Loader wasm_loader.c load_init_expr stack-based overflow

Summaryinfo

A vulnerability classified as critical was found in Bytecode Alliance WebAssembly Micro Runtime up to 2.4.4. Affected by this issue is the function load_init_expr of the file core/iwasm/interpreter/wasm_loader.c of the component Wasm Loader. Such manipulation leads to stack-based overflow. This vulnerability is traded as CVE-2026-54913. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Bytecode Alliance WebAssembly Micro Runtime up to 2.4.4 and classified as critical. Affected by this issue is the function load_init_expr of the file core/iwasm/interpreter/wasm_loader.c of the component Wasm Loader. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. CVE summarizes:

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54913 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2.4.5 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Bytecode Alliance

Name

• WebAssembly Micro Runtime

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion