CVE-2026-54914

Name of the Vulnerable Software and Affected Versions WebAssembly Micro Runtime (WAMR) versions prior to 2.4.5

Description An issue exists where the wasi poll oneoff() function in core/iwasm/libraries/libc-wasi/libc wasi wrapper.c validates the output pointer for only one wasi event t, whereas the wasmtime ssp poll oneoff() function in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as specified by the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while allocating an output region large enough for only one event. This leads to a write operation that crosses the validated Wasm linear-memory boundary into adjacent host heap memory. The resulting overwrite contains partly attacker-controlled event data, which can crash the host process or impact confidentiality and integrity depending on the heap layout.

Recommendations Update to version 2.4.5.