Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54913— WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

Quick assessment

Affected
bytecodealliance wasm-micro-runtime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WebAssembly 微运行时（WAMR）是一个轻量级的独立 WebAssembly（Wasm）运行时。在 2.4.5 版本之前，当编译选项 时， 中的 函数会接受一个非引用堆类型的字节作为 的表示；与此同时，局部变量 联合体未进行零初始化，而设置 时仅写入了该联合体的部分字段。攻击者可构造一个恶意模块，声明一个通过无效的 形式初始化的 、 或 类型的全局变量，从而导致 及后续的全局初始化路径将未初始化的宿主栈字节复制到可由 Guest（即 WebAssembly 模块）读取的值中。此问题影响默认无 GC 配置下

CVSS 6.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
bytecodealliance wasm-micro-runtime < 2.4.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54913

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest
Source: CVE Program / CVE List V5
Vulnerability Description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用未经初始化的变量
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
bytecodealliance wasm-micro-runtime < 2.4.5 -

II. Public POCs for CVE-2026-54913

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54913

请登录查看更多情报信息。

Other References for CVE-2026-54913 (4)

Same Patch Batch · bytecodealliance · 2026-11-05 · 3 CVEs total

CVE-2026-54912 8.8 HIGH WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch
CVE-2026-54914 8.3 HIGH WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

IV. Related Vulnerabilities

Same product: wasm-micro-runtime
Same vendor: bytecodealliance
Same weakness: CWE-457