WebAssembly Micro Runtime Vulnerability in Lightweight Standalone Runtime

CVE-2026-54914

What is CVE-2026-54914?

The WebAssembly Micro Runtime (WAMR) has a vulnerability that allows guest-controlled modules to exploit memory usage patterns. Specifically, prior to version 2.4.5, the wasi_poll_oneoff function improperly validates the output pointer for events. An attacker can craft multiple subscriptions to create events while limiting the output region for a single event. This discrepancy enables potential writes to cross memory boundaries, leading to memory corruption and crashing of the host process, with further risks of disclosing sensitive information or compromising data integrity based on the host's memory layout. Users are advised to upgrade to version 2.4.5 to mitigate this issue.

References