WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasmloader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants inflate the first pass beyond the constant-slot limit, wasmloadergetconstoffset emits later constants inline, but the between-pass sort and deduplication reduces the table so the second pass can choose table references and cause reserveblockret to emit additional copy operands that were not included in codecompiledpeaksize. A crafted module can therefore make the second pass write partially attacker-controlled compiled-code data beyond the heap buffer allocated from the first pass's size calculation during wasmruntimeload, before guest code executes. This can corrupt host heap metadata and deterministically crash the process, causing denial of service; further consequences depend on the host application's heap layout. Builds using WAMRBUILDFASTINTERP=1 are affected; disabling the fast interpreter avoids the vulnerable loader. This issue is fixed in version 2.4.5.

WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode