CVE-2026-54912
Received Received - Intake

WebAssembly Micro Runtime Fast Interpreter Heap Corruption

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants inflate the first pass beyond the constant-slot limit, wasm_loader_get_const_offset emits later constants inline, but the between-pass sort and deduplication reduces the table so the second pass can choose table references and cause reserve_block_ret to emit additional copy operands that were not included in code_compiled_peak_size. A crafted module can therefore make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation during wasm_runtime_load, before guest code executes. This can corrupt host heap metadata and deterministically crash the process, causing denial of service; further consequences depend on the host application's heap layout. Builds using WAMR_BUILD_FAST_INTERP=1 are affected; disabling the fast interpreter avoids the vulnerable loader. This issue is fixed in version 2.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-54912
EUVD
EUVD-2026-117617

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bytecodealliance wasm-micro-runtime < 2.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54912 is a heap buffer overflow in the WebAssembly Micro Runtime (WAMR) fast interpreter loader. It occurs due to inconsistent constant deduplication between two compilation passes. A crafted WebAssembly module can inflate the constant table in the first pass, forcing inline emission of constants. After deduplication in the second pass, the module references constants via table entries, causing the loader to emit additional copy operands that exceed the pre-allocated buffer size. This leads to heap corruption and crashes before guest code execution.

Detection Guidance

This vulnerability is specific to applications using WAMR's fast interpreter (WAMR_BUILD_FAST_INTERP=1) to load untrusted WebAssembly modules. Detection requires checking if your WAMR version is below 2.4.5 and if the fast interpreter is enabled. No direct network detection commands exist; instead, inspect WAMR build configurations and module loading processes.

Impact Analysis

This vulnerability can cause denial of service by crashing the host application deterministically when processing a malicious WebAssembly module. The impact depends on the host application's heap layout; further consequences may include memory corruption or arbitrary code execution if the heap metadata is manipulated. Systems using WAMR's fast interpreter (default mode) to load untrusted WebAssembly modules are at risk.

Mitigation Strategies
  • Upgrade WAMR to version 2.4.5 or later to apply the security fix.
  • If upgrading is not immediately possible, disable the fast interpreter at build time by setting WAMR_BUILD_FAST_INTERP=0.
  • Avoid loading untrusted WebAssembly modules until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...