Out-of-Bounds Array Access in WebAssembly Micro Runtime by Bytecode Alliance
CVE-2025-64713

5.1MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasm-micro-runtime
Vendor
CVE Published:
25 November 2025

What is CVE-2025-64713?

A vulnerability in the WebAssembly Micro Runtime (WAMR) affects its fast interpreter mode during WASM bytecode loading. If the arrays frame_ref_bottom and frame_offset_bottom reach capacity while processing GET_GLOBAL(I32) opcodes, an improper handling may lead to out-of-bounds access. This situation arises when frame_ref_bottom is expanded, but frame_offset_bottom is neglected. This issue manifests particularly when subsequent opcodes are executed, resulting in potential access to invalid memory areas. The vulnerability has been addressed in version 2.4.4, which users are encouraged to upgrade to in order to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

wasm-micro-runtime < 2.4.4

References

https://github.com/bytecodealliance/wasm-micro-runtime/se...
x_refsource_CONFIRM
https://github.com/bytecodealliance/wasm-micro-runtime/re...
x_refsource_MISC

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.