Skip to content
OpenAdvisories

Product · bytecodealliance

wasm-micro-runtime

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-54912

    WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

    WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasm_loader.c can make inconsistent constant-table decisions between the sizing pass and th…

    bytecodealliance wasm-micro-runtime
  • High 8.3
    CVE-2026-54914

    WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

    WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_one…

    bytecodealliance wasm-micro-runtime
  • High 7.0
    CVE-2025-43853

    iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

    The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-u…

    bytecodealliance wasm-micro-runtime