Vulnerabilities (CVE)

Filtered by vendor Bytecodealliance Subscribe

Filtered by product Webassembly Micro Runtime

Total 5 CVE

CVE	Vendors	Products	Updated	CVSS v2	CVSS v3
CVE-2025-43853	1 Bytecodealliance	1 Webassembly Micro Runtime	2025-09-19	N/A	5.5 MEDIUM
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.
CVE-2024-34250	1 Bytecodealliance	1 Webassembly Micro Runtime	2025-06-13	N/A	6.2 MEDIUM
A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" function in core/iwasm/interpreter/wasm_loader.c.
CVE-2024-34251	1 Bytecodealliance	1 Webassembly Micro Runtime	2025-06-13	N/A	7.5 HIGH
An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" function in core/iwasm/interpreter/wasm.h.
CVE-2023-48105	1 Bytecodealliance	1 Webassembly Micro Runtime	2024-11-21	N/A	7.5 HIGH
An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.
CVE-2024-25431	1 Bytecodealliance	1 Webassembly Micro Runtime	2024-11-14	N/A	7.8 HIGH
An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.