Inconsistent Constant Table Management in WebAssembly Micro Runtime (WAMR)

CVE-2026-54912

What is CVE-2026-54912?

The WebAssembly Micro Runtime (WAMR) prior to version 2.4.5 has a vulnerability in its two-pass fast interpreter loader. This issue arises in core/iwasm/interpreter/wasm_loader.c, where inconsistent handling of constant tables occurs during sizing and emitting passes. An attacker can craft a malicious module that inflates the constant-table limit, leading to improperly handled compiled-code output that exceeds allocated heap buffers. This can corrupt critical metadata in the host heap, potentially leading to a denial of service. The fast interpreter mode can be disabled to circumvent this vulnerability, and the issue is resolved in version 2.4.5.

References