CVE-2026-54913

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.

• CWE-457

• https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/c313279c548c6a93f55eb97455cab8696e39f6c1
• https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/e571797fbdf498d9ac4edb495205ea0f01370091
• https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5
• https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-frwm-5hpr-2hq2

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54908Pion DTLS is a Go implementation of Datagram Transport Layer…6.3
• CVE-2026-54909pion/stun is a Go implementation of STUN. Prior to 3.1.3, XO…5.3
• CVE-2026-5491DriveLock Directory Traversal Information Disclosure Vulnera…7.5
• CVE-2026-54910FileBrowser Quantum is a free, self-hosted, web-based file m…7.7
• CVE-2026-54911UltraJSON is a fast JSON encoder and decoder written in pure…6.5
• CVE-2026-54912WebAssembly Micro Runtime (WAMR) is a lightweight standalone…8.8
• CVE-2026-54914WebAssembly Micro Runtime (WAMR) is a lightweight standalone…8.3
• CVE-2026-54915Tautulli is a Python based monitoring and tracking tool for …5.4
• CVE-2026-54916NetBox Device Type Library is a collection of community-sour…8.8
• CVE-2026-54917SeaweedFS is a distributed storage system for object storage…10
• CVE-2026-54918NetBox Device Type Library is a collection of community-sour…5.3
• CVE-2026-54919cpp-httplib is a C++11 single-file header-only cross platfor…7.4