WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.
References
| Link | Resource |
|---|---|
| https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4 | Release Notes |
| https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx | Exploit Vendor Advisory |
Configurations
History
03 Dec 2025, 18:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4 - Release Notes | |
| References | () https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:* | |
| First Time |
Bytecodealliance webassembly Micro Runtime
Bytecodealliance |
25 Nov 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-25 23:15
Updated : 2025-12-03 18:45
NVD link : CVE-2025-64713
Mitre link : CVE-2025-64713
CVE.ORG link : CVE-2025-64713
JSON object : View
Products Affected
bytecodealliance
- webassembly_micro_runtime
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer