CVE-2025-58749 — Integer Overflow or Wraparound in Wasm-micro-runtime

CWE-190 — Integer Overflow or WraparoundCWE-822 — Untrusted Pointer Dereference2 documents2 sources
Severity
2.1LOWNVD
EPSS
0.1%
top 81.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Bytecodealliance Wasm-micro-runtimeBytecodealliance Webassembly Micro RuntimeMsrc Azl3 Fluent-bit 3.1.9-5 ON Azure Linux 3.0+3 more
Timeline
Latest updateSep 9
PublishedSep 16

Description

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first operand (memory address pointer) is greater than or equal to 2147483648 bytes (2GiB). This causes the runtime to hang in release builds or crash in debug builds due to accessing an invalid pointer. The issue does not occur in…

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages6 packages

Patches

Patch: github.com ↗

📋Vendor Advisories

1
Microsoft
WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode↗2025-09-09
▶
CVE-2025-58749 — Integer Overflow or Wraparound | cvebase