Read the docs
TI-2025-40059 Aliases CVE-2025-64713

Memory corruption in bytecodealliance wasm-micro-runtime

Priority HIGH 66CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed wasm-micro-runtime (bytecodealliance): 2.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasm-micro-runtimebefore 2.4.42.4.4Patch availableCNA
  • wasm-micro-runtime Vendorbytecodealliance Affected before 2.4.4 Fixed in 2.4.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:*before 2.4.4Vulnerablebytecodealliance
  • cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:* Versions before 2.4.4 Vulnerable ·bytecodealliance

Remediation

  • Fix · CNA wasm-micro-runtime (bytecodealliance) Fixed in 2.4.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64713

References

Exploit 1

Other 1

  • TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
  • TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
  • TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
  • TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
  • TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
  • TI-2024-22657 A heap buffer overflow vulnerability was discovered in Bytecode Alliance… CVSS 3.1MEDIUM 6.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences