AIKIDO-2026-194890

TL;DR

The loader handles constant initializer expressions, including ref.null, while parsing a module. The ref.null handler accepts an arbitrary heap type and writes only the reference index into an otherwise uninitialized value structure. The remaining bytes retain uninitialized host memory that can later be read back, disclosing stack contents. The fix zero-initializes the value and rejects reference types other than the supported ones.