Login Request a demo
Medium severity · published Sep 16, 2025
CVE-2025-58749
WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first operand (memory address pointer) is greater than or equal to 2147483648 bytes (2GiB). This causes the runtime to hang in release builds or crash in debug builds due to accessing an invalid pointer. The issue does not occur in FAST-JIT mode or other runtime tools. This has been fixed in version 2.4.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wasm-micro-runtime · bytecodealliance
< 2.4.2 · source: vendor
WM
Webassembly Micro Runtime · Bytecodealliance
before 2.4.2 · source: NVD
Affected product
WA
wasm-micro-runtime
bytecodealliance
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58749
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58749
Patch
https://github.com/bytecodealliance/wasm-micro-runtime/commit/95f506a6e77d3ac7588eac7263f95558edfa7f3b
Exploit
https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-xj5p-r8jq-pw47
More from wasm-micro-runtime
7.5
CVE-2024-34251
An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the…
7.4
CVE-2025-64713
WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode
6.2
CVE-2024-34250
A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the…
5.5
CVE-2025-64704
WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
5.5
CVE-2025-43853
iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature