Bytecodealliance Wasm-micro-runtime vulnerabilities

• bytecodealliance wasm-micro-runtime WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch CVE-2026-54912 8.8 HighNovember 5, 2026
• bytecodealliance wasm-micro-runtime WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest CVE-2026-54913 6.9 MediumNovember 5, 2026
• bytecodealliance wasm-micro-runtime WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer CVE-2026-54914 8.3 HighNovember 5, 2026
• bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 more WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode CVE-2025-64713 5.1 MediumNovember 25, 2025
• bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 more WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction CVE-2025-64704 4.7 MediumNovember 25, 2025
• bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 more WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode CVE-2025-58749 Fix available 2.1 LowSeptember 16, 2025
• bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 more WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVE-2025-54126 Fix available 6.9 MediumJuly 29, 2025
• bytecodealliance webassembly micro runtime, wasm-micro-runtime +1 more iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature CVE-2025-43853 7.0 HighMay 15, 2025