2.1
Low
CVE-2025-58749 WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime
Description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first operand (memory address pointer) is greater than or equal to 2147483648 bytes (2GiB). This causes the runtime to hang in release builds or crash in debug builds due to accessing an invalid pointer. The issue does not occur in FAST-JIT mode or other runtime tools. This has been fixed in version 2.4.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wasm-micro-runtime 2.4 | earliest → < 2.4.2 | 2.4.2 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of wasm-micro-runtime
The 8 CVEs of wasm-micro-runtime →
CVE-2026-54912
WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch
8.8
High
CVE-2026-54913
WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest
6.9
Medium
CVE-2026-54914
WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer
8.3
High
CVE-2025-64713
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime
5.1
Medium