CVE-2025-64704— WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
Quick assessment
Affected
bytecodealliance wasm-micro-runtime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WebAssembly Micro Runtime（WAMR）是Bytecode Alliance开源的一种轻量级的独立 WebAssembly 运行时。具有占用空间小、高性能和高度可配置的功能，适用于从嵌入式、物联网、边缘到可信执行环境 (TEE)、智能合约、云原生等应用程序。 WebAssembly Micro Runtime 2.4.4之前版本存在代码问题漏洞，该漏洞源于v128.store指令中存在分段错误。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-64704
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
Source: CVE Program / CVE List V5
Vulnerability Description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentation fault in v128.store instruction. This issue has been patched in version 2.4.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5
Vulnerability Title
WebAssembly Micro Runtime 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WebAssembly Micro Runtime（WAMR）是Bytecode Alliance开源的一种轻量级的独立 WebAssembly 运行时。具有占用空间小、高性能和高度可配置的功能，适用于从嵌入式、物联网、边缘到可信执行环境 (TEE)、智能合约、云原生等应用程序。 WebAssembly Micro Runtime 2.4.4之前版本存在代码问题漏洞，该漏洞源于v128.store指令中存在分段错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bytecodealliance | wasm-micro-runtime | < 2.4.4 | - |
|
II. Public POCs for CVE-2025-64704
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-64704
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: wasm-micro-runtime
-
CVE-2025-64713
WebAssembly Micro Runtime frame_offset_bottom array bounds o -
CVE-2025-58749
WAMR runtime hangs or crashes with large memory.fill address -
CVE-2025-54126
WebAssembly Micro Runtime's `--addr-pool` option allows all -
CVE-2025-43853
iwasm vulnerable to filesystem sandbox escape with symlink w
Same vendor: bytecodealliance
-
CVE-2026-104855
Wasmtime: Preemption and traps during bulk operations enable -
CVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms f -
CVE-2026-54786
Wasmtime: Leak in WASIp1 `fd_renumber` implementation -
CVE-2026-47261
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRIT -
CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o
Same weakness: CWE-754
-
CVE-2026-104432
Zebra before 6.3.0 False Readiness via Discarded One-Hash Fi -
CVE-2026-100296
Improper Check for Unusual or Exceptional Conditions in Anjv -
CVE-2026-95330
Chrome<154.0.8037.57下载状态校验缺陷致权限绕过 -
CVE-2026-73549
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddre -
CVE-2026-94105
NivoCart through 2.4.0 Destructive Configuration Write via t
V. Comments for CVE-2025-64704
No comments yet