WebAssembly Micro Runtime Vulnerability in Version Prior to 2.4.5

CVE-2026-54913

What is CVE-2026-54913?

The WebAssembly Micro Runtime prior to version 2.4.5 includes a vulnerability where the load_init_expr function accepts a non-reference heap-type byte for ref.null without proper zero-initialization of the local WASMValue cur_value union. This oversight allows a specially crafted WebAssembly module to declare global types such as i64, f64, or v128 initialized incorrectly through the invalid ref.null form. Consequently, unintended host-stack bytes may be copied into values accessible by the WebAssembly guest, enabling potential data leakage. Affected configurations include those running without garbage collection, while the GC-enabled path implements type validation, mitigating the issue.

References