AIKIDO-2026-524183
bytecodealliance.wasm-micro-runtime is vulnerable to Heap-based Buffer Overflow
90
Critical Risk
This Affects:
bytecodealliance.wasm-micro-runtimeTL;DR
WebAssembly runtimes expose the WASI poll_oneoff API to guest modules through the libc-wasi wrapper. The dispatcher validates the guest-supplied output buffer for only a single event structure regardless of the requested nsubscriptions count. A guest module that requests two or more subscriptions writes event results past the end of the validated buffer, corrupting adjacent heap memory. The fix validates the full input and output buffers against the number of subscriptions before use.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you build with the libc-wasi support that exposes the poll_oneoff API to guest modules.
Background info
bytecodealliance.wasm-micro-runtime is vulnerable to Heap-based Buffer Overflow in versions 0.0.1 - 2.4.4.
How to fix this
Upgrade the bytecodealliance.wasm-micro-runtime library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant