CVE-2025-64713 Details
Description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.
A moderate severity out-of-bounds array access vulnerability has been identified in WebAssembly Micro Runtime (WAMR) versions prior to 2.4.4. The issue arises in the fast interpreter mode during WASM bytecode loading. When the 'frame_ref_bottom' and 'frame_offset_bottom' arrays are full and a 'GET_GLOBAL(I32)' opcode is processed, the 'frame_ref_bottom' array is expanded, but the 'frame_offset_bottom' array may not be. If this situation is followed by an 'if' opcode that activates 'preserve_local_for_block', the function iterates through the arrays using 'stack_cell_num' as the upper limit. This can lead to an out-of-bounds access on 'frame_offset_bottom', as it was not expanded to correspond with the increased 'stack_cell_num'.
Users can upgrade to WAMR version 2.4.4, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 26, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4 | [email protected] | Release Notes |
| https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance webassembly micro runtime | < 2.4.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Nov 25, 2025 | New CVE Received | [email protected] |