CVE-2026-54914

Received Received - Intake

Memory Corruption in WebAssembly Micro Runtime

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-54914

EUVD

EUVD-2026-117615

Affected Vendors & Products

Vendor	Product	Version / Range
bytecodealliance	wasm-micro-runtime	< 2.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2026-54914 is a heap buffer overflow in the WebAssembly Micro Runtime (WAMR) WASI implementation of the poll_oneoff function. The issue occurs when the output buffer validation only checks for space for one event but the implementation can write up to nsubscriptions events. A crafted Wasm module can exploit this by providing multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later write to cross the validated Wasm linear-memory boundary into adjacent host heap memory.

Detection Guidance

To detect this vulnerability, check the version of WAMR installed on your system. Run: wasm-micro-runtime --version or inspect the library files for the vulnerable code. If using a package manager, check for updates to version 2.4.5 or later.

Impact Analysis

This vulnerability can crash the host process reliably. It may also lead to further confidentiality or integrity consequences depending on heap layout. An attacker could potentially execute arbitrary code or cause denial of service in the host process by exploiting this issue through any application using WAMR to execute untrusted Wasm code.

Mitigation Strategies

Immediately upgrade to WAMR version 2.4.5 or later. If upgrading is not possible, disable WASI poll_oneoff functionality in your WAMR configuration or avoid executing untrusted WebAssembly modules until patched.

Hi! I’m here to help you understand CVE-2026-54914. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...