{"id":"CVE-2026-54912","kind":"vulnerability","aliases":["CVE-2026-54912"],"related":[],"title":"WAMR: crafted Wasm module corrupts heap and crashes the host process","description":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants inflate the first pass beyond the constant-slot limit, wasm_loader_get_const_offset emits later constants inline, but the between-pass sort and deduplication reduces the table so the second pass can choose table references and cause reserve_block_ret to emit additional copy operands that were not included in code_compiled_peak_size. A crafted module can therefore make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation during wasm_runtime_load, before guest code executes. This can corrupt host heap metadata and deterministically crash the process, causing denial of service; further consequences depend on the host application's heap layout. Builds using WAMR_BUILD_FAST_INTERP=1 are affected; disabling the fast interpreter avoids the vulnerable loader. This issue is fixed in version 2.4.5.","summary":"WebAssembly Micro Runtime (WAMR) before 2.4.5 has a heap buffer overflow in its fast interpreter loader, triggered by a crafted module during loading. An attacker who supplies a malicious Wasm module can corrupt host heap metadata and deterministically crash the process, causing denial of service; further impact depends on the host application's heap layout.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-runtime","runtime","wamr","webassembly"],"not_affected_if":["fast-interp-disabled","trusted-modules-only"],"how_to_check":"- Check whether the build sets `WAMR_BUILD_FAST_INTERP=1`, which the sources say is required for the flaw.\n- Check the WAMR version in use against `2.4.5`.","fix":"- WAMR: move to `2.4.5` or later.","status":"open","published_at":"2026-11-05T18:17:08+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","triaged_at":"2026-11-05T18:40:20+00:00","updated_at":"2026-11-05T18:40:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T18:40:20Z","model":"claude-haiku-5-5","output":{"fix":"- WAMR: move to `2.4.5` or later.","reach":"network","title":"WAMR: crafted Wasm module corrupts heap and crashes the host process","impact":"medium","summary":"WebAssembly Micro Runtime (WAMR) before 2.4.5 has a heap buffer overflow in its fast interpreter loader, triggered by a crafted module during loading. An attacker who supplies a malicious Wasm module can corrupt host heap metadata and deterministically crash the process, causing denial of service; further impact depends on the host application's heap layout.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wamr","webassembly","embedded-runtime"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker crashes host process by corrupting heap metadata during module load","analyst_note":"","how_to_check":"- Check whether the build sets `WAMR_BUILD_FAST_INTERP=1`, which the sources say is required for the flaw.\n- Check the WAMR version in use against `2.4.5`.","plain_action":"","needs_analyst":false,"not_affected_if":["fast-interp-disabled","trusted-modules-only"],"who_is_affected":"Applications that embed WAMR and load untrusted or attacker-supplied WebAssembly modules are exposed, and only builds with WAMR_BUILD_FAST_INTERP=1 are affected. Teams that run only trusted modules, or that build with the fast interpreter disabled, can deprioritize this; the sources say disabling the fast interpreter avoids the vulnerable loader.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4583,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54912':14A,17A '1':246C '2.4.5':29B,92C,263C 'addit':165C 'affect':248C 'alloc':199C 'applic':75B,236C 'attack':48B,189C 'attacker-control':188C 'avoid':253C 'between-pass':141C 'beyond':124C,195C 'block':161C 'buffer':33B,198C 'build':240C,243C 'calcul':206C 'caus':65B,159C,226C 'choos':155C 'code':173C,193C,213C 'compil':174C,192C 'compiled-cod':191C 'consequ':231C 'const':133C 'constant':106C,119C,127C,137C 'constant-slot':126C 'constant-t':105C 'control':190C 'copi':166C 'core/iwasm/interpreter/wasm_loader.c':101C 'corrupt':5A,56B,217C 'craft':2A,43B,178C 'crash':8A,62B,223C 'cve':12A,15A 'data':194C 'decis':108C 'dedupl':146C 'denial':66B,227C 'depend':71B,232C 'determinist':61B,222C 'disabl':249C 'duplic':118C 'embed':19B 'embedded-runtim':18B 'emit':115C,135C,164C 'execut':214C 'fast':37B,97C,244C,251C 'first':122C,202C 'fix':260C 'get':132C 'guest':212C 'heap':6A,32B,58B,77B,197C,219C,238C 'host':10A,57B,74B,218C,235C 'impact':70B 'includ':171C 'inconsist':104C 'inflat':120C 'inlin':138C 'interp':245C 'interpret':38B,98C,252C 'issu':258C 'later':136C 'layout':78B,239C 'lightweight':85C 'limit':129C 'load':46B,210C 'loader':39B,99C,131C,256C 'make':103C,182C 'malici':52B 'metadata':59B,220C 'micro':25B,80C 'modul':4A,44B,54B,179C 'offset':134C 'operand':167C 'overflow':34B 'partial':187C 'pass':96C,112C,116C,123C,143C,153C,185C,203C 'peak':175C 'prior':90C 'process':11A,64B,225C 'reduc':147C 'refer':157C 'reserv':160C 'ret':162C 'runtim':20B,21B,26B,81C,89C,209C 'second':152C,184C 'servic':68B,229C 'size':111C,176C,205C 'slot':128C 'sort':144C 'standalon':86C 'suppli':50B 'tabl':107C,149C,156C 'therefor':181C 'trigger':40B 'two':95C 'two-pass':94C 'use':241C 'version':262C 'vulner':255C 'wamr':1A,22B,27B,82C,242C 'wasm':3A,53B,88C,130C,208C 'webassembl':23B,24B,79C,87C 'write':186C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed WAMR and load untrusted or attacker-supplied WebAssembly modules are exposed, and only builds with WAMR_BUILD_FAST_INTERP=1 are affected. Teams that run only trusted modules, or that build with the fast interpreter disabled, can deprioritize this; the sources say disabling the fast interpreter avoids the vulnerable loader.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embeddedruntime","high","runtime","wamr","webassembly"],"campaign_type":null,"first_public_at":"2026-08-04T07:24:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54912","severity":null,"published_at":"2026-11-05T18:17:08+00:00","modified_at":"2026-11-05T18:17:08+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","fetched_at":"2026-11-05T18:40:09+00:00","note":null}],"documents":[{"id":78691,"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/b1353b5e8983047ff68829c99abf1355d5f389cf","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78692,"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78693,"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-jjv3-x3jf-cg49","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-04T07:24:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}