{"cve":"CVE-2025-64713","enrichment":{"created":"2025-11-27T16:26:02.686279+00:00","updated":"2025-11-27T16:26:02.686309+00:00","vendors":["bytecodealliance","bytecodealliance$PRODUCT$webassembly_micro_runtime"]},"epss":{"score":0.00327},"mitre":{"cpes":[],"created":"2025-11-25T22:13:47.662000+00:00","description":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2025/64xxx/CVE-2025-64713.json","references":["https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4","https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx"],"title":"WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode","updated":"2025-11-26T14:50:41.885000+00:00","vendors":[],"weaknesses":["CWE-119"]},"nvd":{"cpes":["cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:*"],"created":"2025-11-25T23:15:47.763000+00:00","description":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2025/CVE-2025-64713.json","references":["https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4","https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx"],"title":null,"updated":"2026-06-17T09:55:05.447000+00:00","vendors":["bytecodealliance","bytecodealliance$PRODUCT$webassembly_micro_runtime"],"weaknesses":["CWE-119"]},"opencve":{"changes":[{"created":"2025-11-25T22:30:00+00:00","data":[{"details":{"new":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.","old":null},"type":"description"},{"details":{"new":"WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode","old":null},"type":"title"},{"details":{"added":["CWE-119"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4","https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"c1ed7ca9-eea3-4724-9385-7b5316389a1f"},{"created":"2025-11-26T15:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"08ed4bd3-4541-43a3-9750-02299a1418cb"},{"created":"2025-11-27T16:30:00+00:00","data":[{"details":["bytecodealliance","bytecodealliance$PRODUCT$webassembly_micro_runtime"],"type":"first_time"},{"details":{"added":["bytecodealliance","bytecodealliance$PRODUCT$webassembly_micro_runtime"],"removed":[]},"type":"vendors"}],"id":"8cb14559-370b-47e3-b2eb-62432bba0c31"},{"created":"2025-12-03T19:00:00+00:00","data":[{"details":{"added":["cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"88730785-68b8-4228-9b06-bcb495e2cda9"}],"cpes":{"data":["cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2025-11-25T22:13:47.662000+00:00","provider":"mitre"},"description":{"data":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00327},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4","https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-gvx3-gg3x-rjcx"],"providers":["mitre","nvd"]},"title":{"data":"WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode","provider":"mitre"},"updated":{"data":"2025-12-03T18:45:40.897000+00:00","provider":"nvd"},"vendors":{"data":["bytecodealliance","bytecodealliance$PRODUCT$webassembly_micro_runtime"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-119"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2025-11-25T22:13:47.662000+00:00","description":"WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading. When frame_ref_bottom and frame_offset_bottom arrays are at capacity and a GET_GLOBAL(I32) opcode is encountered, frame_ref_bottom is expanded but frame_offset_bottom may not be. If this is immediately followed by an if opcode that triggers preserve_local_for_block, the function traverses arrays using stack_cell_num as the upper bound, causing out-of-bounds access to frame_offset_bottom since it wasn't expanded to match the increased stack_cell_num. This issue has been patched in version 2.4.4.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode","updated":"2025-11-26T14:50:37.826000+00:00","vendors":[],"vulnrichment_repo_path":"2025/64xxx/CVE-2025-64713.json","weaknesses":[]}}