{"affected":[{"product":"wasm-micro-runtime","source":"CNA: GitHub_M","vendor":"bytecodealliance","versions":[{"status":"affected","version":"< 2.4.5"}]}],"cveId":"CVE-2026-54914","cwes":["CWE-122"],"description":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793899636493,"publishedAt":1793899636493,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-wj3p-xhqm-pffc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/1f98fb01d09b2ef5e49dc0be2e6006f962fd87f1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/b49d10eac4176817305d60ea59d24bc69a53eb7b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5"}],"remediation":[],"revision":"2508f56b370c37d6672f861cc3ae43fd052fa550ca97bbe21faf5fed90f5d8f7","sources":[{"modifiedAt":1793899636493,"name":"CNA: GitHub_M","retrievedAt":1793902262016,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54914"}],"ssvc":null,"status":"published","title":"WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer","updatedAt":1793902262016}