CVE-2026-54914 · Runtime
NO FIX YET · SEE WHAT TO DO
WebAssembly Micro Runtime (WAMR) before 2.4.5 has a bounds-check flaw in its WASI poll_oneoff handling. A crafted guest module can write event data past the validated Wasm memory into adjacent host heap, reliably crashing the host process and possibly exposing or corrupting data.
first public Jul 16, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed WAMR and run WebAssembly modules supplied by someone else, such as plugins, user uploads or multi-tenant workloads, with WASI poll support enabled. Teams running only trusted, self-written Wasm modules face much lower risk, but should still upgrade to 2.4.5.
Not affected if trusted-modules-only, wasi-poll-unused
Who cares embedded-runtime, wamr, wasi, webassembly
iwasm --version or the WAMR version in your build configuration; versions below 2.4.5 are affected.2.4.5 or later.WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.