# CVE-2026-54913: WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, load_init_expr in core/iwasm/interpreter/wasm_loader.c accepts a non-reference heap-type byte for ref.null when WASM_ENABLE_GC=0, while the local WASMValue cur_value union is not zero-initialized and setting ref_index writes only part of it. A crafted module can declare an i64, f64, or v128 global initialized through the invalid ref.null form, causing push_const_expr_stack and the later global initialization path to copy uninitialized host-stack bytes into a value readable by the guest. The classic and fast interpreters are affected in the default no-GC configuration; the GC-enabled path validates heap types. The disclosure is four bytes for i64 or f64 globals and up to twelve bytes for each v128 global. This issue is fixed in version 2.4.5.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- bytecodealliance / wasm-micro-runtime: < 2.4.5 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-457

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-frwm-5hpr-2hq2 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/c313279c548c6a93f55eb97455cab8696e39f6c1 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/e571797fbdf498d9ac4edb495205ea0f01370091 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-54913; retrieved 2026-11-05; source updated 2026-11-05

Revision: 3334722bd5f91fab6232749165b1f36b802f9726f55920a08cfe9b69e602dc3e

Canonical: https://y2.dev/cve/CVE-2026-54913

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.