CVE-2026-54912— WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

Quick assessment

Affected

bytecodealliance wasm-micro-runtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WebAssembly Micro Runtime（WAMR）是一款轻量级、独立运行的 WebAssembly（Wasm）运行时。在 2.4.5 版本之前，位于中的两阶段快速解释器加载器在“尺寸计算阶段”与“代码生成阶段”之间，可能对常量表做出不一致的决策。当重复常量导致第一阶段超出常量槽位限制时，会将后续常量以内联方式发出；然而，两阶段之间的排序与去重操作会缩减常量表，使得第二阶段转而选择常量表引用，并调用生成额外的复制操作数，而这些操作数并未被计入的计算中。因此，攻击者可构造恶意模块，在函数根据第一阶

CVSS 8.8 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

Source: CVE Program / CVE List V5

Vulnerability Description

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants inflate the first pass beyond the constant-slot limit, wasm_loader_get_const_offset emits later constants inline, but the between-pass sort and deduplication reduces the table so the second pass can choose table references and cause reserve_block_ret to emit additional copy operands that were not included in code_compiled_peak_size. A crafted module can therefore make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation during wasm_runtime_load, before guest code executes. This can corrupt host heap metadata and deterministically crash the process, causing denial of service; further consequences depend on the host application's heap layout. Builds using WAMR_BUILD_FAST_INTERP=1 are affected; disabling the fast interpreter avoids the vulnerable loader. This issue is fixed in version 2.4.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasm-micro-runtime	< 2.4.5	-

II. Public POCs for CVE-2026-54912

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54912

请登录查看更多情报信息。

Other References for CVE-2026-54912 (4)

https://gist.github.com/shumbo/b710c35b005ed871447fce385d1ab760 x_refsource_MISC
https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5 x_refsource_MISC
https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-jjv3-x3jf-cg49 x_refsource_CONFIRM
https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/b1353b5e8983047ff68829c99abf1355d5f389cf x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54912

Same Patch Batch · bytecodealliance · 2026-11-05 · 3 CVEs total

CVE-2026-54914	8.3 HIGH	WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer
CVE-2026-54913	6.9 MEDIUM	WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` lea

IV. Related Vulnerabilities

Same product: wasm-micro-runtime

Same vendor: bytecodealliance

Same weakness: CWE-787