CVE-2025-64713: WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When framerefbottom and frameoffsetbottom arrays are at capacity and a GETGLOBAL(I32) opcode is encountered, framerefbottom is expanded but frameoffsetbottom may not be. If this is immediately followed by an if opcode that triggers preservelocalforblock, the function traverses arrays using stackcellnum as the upper bound, causing out-of-bounds access to frameoffsetbottom since it wasn't expanded to match the increased stackcellnum. This issue has been patched in version 2.4.4.
Other sources
WebAssembly Micro Runtime frameoffsetbottom array bounds overflow in fast Interpreter mode when handling GETGLOBAL(I32) followed by if opcode
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64713?
CVE-2025-64713 has been classified as a high severity vulnerability due to its potential to cause out-of-bounds array access.
How do I fix CVE-2025-64713?
To fix CVE-2025-64713, update WebAssembly Micro Runtime to version 2.4.4 or later.
What causes the vulnerability in CVE-2025-64713?
CVE-2025-64713 is caused by an out-of-bounds array access issue in the fast interpreter mode during WASM bytecode loading before version 2.4.4.
Which versions of WebAssembly Micro Runtime are affected by CVE-2025-64713?
Versions of WebAssembly Micro Runtime prior to 2.4.4 are affected by CVE-2025-64713.
What impact does CVE-2025-64713 have on applications using WebAssembly Micro Runtime?
CVE-2025-64713 could potentially allow an attacker to exploit applications utilizing the affected version of WebAssembly Micro Runtime, leading to unexpected behavior or security breaches.