---
id: CVE-2026-54913
title: >-
  WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in
  `load_init_expr` leaks host stack memory to the WebAssembly guest
summary: >-
  WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly
  (Wasm) runtime. Prior to 2.4.5, load_init_expr in
  core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte
  for ref.null when WASM_ENABLE_GC=0, wh…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-457
vendor: bytecodealliance
product: wasm-micro-runtime
affected:
  - wasm-micro-runtime < 2.4.5
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T17:28:26.923Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54913'
references:
  - url: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-frwm-5hpr-2hq2
    label: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-frwm-5hpr-2hq2
  - url: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/c313279c548c6a93f55eb97455cab8696e39f6c1
    label: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/c313279c548c6a93f55eb97455cab8696e39f6c1
  - url: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/e571797fbdf498d9ac4edb495205ea0f01370091
    label: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/e571797fbdf498d9ac4edb495205ea0f01370091
  - url: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5
    label: >-
      https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.438Z'
---

## Overview

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.

## Affected

- `wasm-micro-runtime < 2.4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.