WebAssembly Micro Runtime Vulnerability in LLVM-JIT Mode by ByteCode Alliance
CVE-2025-58749

2.1LOW

Key Information:

Vendor

Bytecodealliance

Status
Wasm-micro-runtime
Vendor
CVE Published:
16 September 2025

What is CVE-2025-58749?

In the WebAssembly Micro Runtime (WAMR) versions prior to 2.4.2, there exists a vulnerability when running in LLVM-JIT mode. This vulnerability manifests when executing WebAssembly programs that utilize the memory.fill instruction with an address pointer greater than or equal to 2GiB, leading to the runtime hanging in release builds and crashing in debug builds due to accessing invalid pointers. This issue does not affect the FAST-JIT mode or other runtime instances and has been rectified in the subsequent version 2.4.2.

Affected Version(s)

wasm-micro-runtime < 2.4.2

References

https://github.com/bytecodealliance/wasm-micro-runtime/se...
x_refsource_CONFIRM
https://github.com/bytecodealliance/wasm-micro-runtime/co...
x_refsource_MISC

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.