PT-2025-38054 · Unknown · Webassembly Micro Runtime

Gaaraw + 1 · Published 2025-09-16 · Updated 2025-09-17 · CVE-2025-58749

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WebAssembly Micro Runtime (WAMR) versions prior to 2.4.2

Description WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. When running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first operand (memory address pointer) is greater than or equal to 2147483648 bytes (2GiB). This causes the runtime to hang in release builds or crash in debug builds due to accessing an invalid pointer. The issue does not occur in FAST-JIT mode or other runtime tools.

Recommendations Update to version 2.4.2 or later.

Exploit

Fix

Untrusted Pointer Dereference

Integer Overflow

Weakness Enumeration

CWE-822

CWE-190

Related Identifiers

AZL-67608

AZL-67617

CVE-2025-58749

GHSA-XJ5P-R8JQ-PW47

Affected Products

Webassembly Micro Runtime

References · 8

• 🔥 https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-xj5p-r8jq-pw47 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58749.json · Exploit
• https://osv.dev/vulnerability/AZL-67617 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-67608 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58749 · Security Note
• https://github.com/bytecodealliance/wasm-micro-runtime/commit/95f506a6e77d3ac7588eac7263f95558edfa7f3b · Note
• https://twitter.com/CVEnew/status/1968190838569054578 · Twitter Post