bytecodealliance wasm-micro-runtime vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 20263

Newest CVEs

• CVE-2026-54912

  WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch

  bytecodealliance · wasm-micro-runtime

  High8.8
• CVE-2026-54913

  WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

  bytecodealliance · wasm-micro-runtime

  Medium6.9
• CVE-2026-54914

  WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer

  bytecodealliance · wasm-micro-runtime

  High8.3
• CVE-2025-64713

  WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode

  bytecodealliance · wasm-micro-runtime

  Medium5.1
• CVE-2025-64704

  WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction

  bytecodealliance · wasm-micro-runtime

  Medium4.7
• CVE-2025-58749

  WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode

  bytecodealliance · wasm-micro-runtime

  Low2.1
• CVE-2025-54126

  WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified

  bytecodealliance · wasm-micro-runtime

  Medium6.9
• CVE-2025-43853

  iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

  bytecodealliance · wasm-micro-runtime

  High7.0