CVE-2026-54914— WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

Quick assessment

Affected

bytecodealliance wasm-micro-runtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WebAssembly 微运行时（WAMR）是一个轻量级的独立 WebAssembly（Wasm）运行时。在 2.4.5 版本之前，中的函数仅对单个的输出指针进行验证，而中的函数却能够根据由客户端（guest）控制的值写入任意数量的事件。攻击者可构造一个客户端模块，提供多个能触发事件的订阅项，同时将输出区域设置为仅能容纳单个事件的大小，从而导致后续对的写入操作越过经过验证的 Wasm 线性内存边界，写入到相邻的宿主堆内存中。被覆盖的数据部分由攻击者控制，可可靠地导致宿主进程崩溃，并可能根据堆内存布局引

CVSS 8.3 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1068.001 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

Source: CVE Program / CVE List V5

Vulnerability Description

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasm-micro-runtime	< 2.4.5	-

II. Public POCs for CVE-2026-54914

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54914

请登录查看更多情报信息。

Other References for CVE-2026-54914 (4)

https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5 x_refsource_MISC
https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-wj3p-xhqm-pffc x_refsource_CONFIRM
https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/1f98fb01d09b2ef5e49dc0be2e6006f962fd87f1 x_refsource_MISC
https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/b49d10eac4176817305d60ea59d24bc69a53eb7b x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54914

Same Patch Batch · bytecodealliance · 2026-11-05 · 3 CVEs total

CVE-2026-54912	8.8 HIGH	WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch
CVE-2026-54913	6.9 MEDIUM	WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` lea

IV. Related Vulnerabilities

Same product: wasm-micro-runtime

Same vendor: bytecodealliance

Same weakness: CWE-122