CVE-2026-54913

Received Received - Intake

Memory Corruption in WebAssembly Micro Runtime

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-54913

EUVD

EUVD-2026-117616

Affected Vendors & Products

Vendor	Product	Version / Range
bytecodealliance	wasm-micro-runtime	< 2.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

Executive Summary

This vulnerability in WebAssembly Micro Runtime (WAMR) occurs when the load_init_expr function fails to validate heap types for ref.null instructions when WASM_ENABLE_GC=0. A local WASMValue variable is not zero-initialized, causing uninitialized stack memory to leak when the variable is partially updated. A crafted WebAssembly module can exploit this to declare globals with invalid ref.null forms, leading to memory disclosure of host stack data.

Detection Guidance

Detecting this vulnerability requires checking the version of WAMR installed on your system. Use the command 'wamrc --version' or inspect the runtime's version in your application logs. If you are running a version prior to 2.4.5, the system is vulnerable.

Impact Analysis

An attacker could craft a malicious WebAssembly module that exploits this flaw to read uninitialized host memory. This could expose sensitive data, such as secrets or internal process information, to the guest environment. The impact includes potential data leaks and violation of sandboxing guarantees.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected WAMR versions may face compliance risks due to potential data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade to WAMR version 2.4.5 or later immediately. Disable WebAssembly modules from untrusted sources until the upgrade is complete. Monitor for unusual memory access patterns or data leaks in guest environments.

Hi! I’m here to help you understand CVE-2026-54913. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...