CVE-2026-54914: WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasipolloneoff in core/iwasm/libraries/libc-wasi/libcwasiwrapper.c validates the output pointer for only one wasieventt, while wasmtimessppolloneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebAssembly Micro Runtime (WAMR)to a version that resolves this vulnerability.Fixed in 2.4.5
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using WebAssembly Micro Runtime versions prior to 2.4.5 are affected when they execute a crafted guest WebAssembly module that can invoke the WASI poll_oneoff path.
What does an attacker need to trigger the issue?
An attacker needs to supply or cause execution of a crafted guest module. The module uses multiple subscriptions that produce events while supplying an output region sized for only one wasi_event_t.
What is the practical impact of successful exploitation?
The out-of-bounds write can reliably crash the host process. Because the write crosses the validated Wasm linear-memory boundary into adjacent host heap memory and includes partly attacker-controlled event data, confidentiality or integrity effects may also be possible depending on heap layout.
What should teams do if they are affected?
Upgrade WebAssembly Micro Runtime to version 2.4.5. If upgrading cannot happen immediately, avoid executing untrusted guest modules that can reach WASI poll_oneoff.