wasm-micro-runtime vulnerabilities

CVEs whose affected-version data names the wasm-micro-runtime package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-54912High· 8.8PoC

yesterday

WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between …

▾ Midnightbytecodealliance · wasm-micro-runtimevia CVEORG

CVE-2026-54914High· 8.3

yesterday

WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while…

▾ Twilightbytecodealliance · wasm-micro-runtimevia CVEORG

CVE-2026-54913Medium· 6.9

yesterday

WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, wh…

▾ Sunlitbytecodealliance · wasm-micro-runtimevia CVEORG