CVE-2025-64704: WebAssembly Micro Runtime Buffer Overflow

CVE-2025-64704 Overview

CVE-2025-64704 affects WebAssembly Micro Runtime (WAMR), a lightweight standalone WebAssembly (Wasm) runtime maintained by the Bytecode Alliance. Versions prior to 2.4.4 contain a flaw that triggers a segmentation fault when processing the v128.store SIMD instruction. The runtime fails to properly validate conditions before executing the store, leading to an abnormal process termination. The issue is tracked under [CWE-754: Improper Check for Unusual or Exceptional Conditions]. Exploitation requires a local attacker to supply a crafted Wasm module and user interaction to load it. Successful exploitation produces a denial-of-service condition against the host process embedding WAMR.

Critical Impact
A malicious Wasm module can crash the WAMR runtime through the v128.store instruction, causing denial of service in any application embedding vulnerable WAMR versions.

Affected Products

Bytecode Alliance WebAssembly Micro Runtime (WAMR) versions prior to 2.4.4
Applications and embedded systems linking vulnerable WAMR releases
IoT and edge devices using WAMR for Wasm module execution

Discovery Timeline

2025-11-25 - CVE-2025-64704 published to the National Vulnerability Database
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-64704

Vulnerability Analysis

The vulnerability resides in WAMR's handling of the WebAssembly SIMD v128.store instruction. This instruction writes a 128-bit vector value to linear memory at a computed address. WAMR fails to perform required checks before dispatching the store operation, resulting in a segmentation fault during execution. The flaw maps to [CWE-754], which covers improper checks for unusual or exceptional conditions. Because WAMR runs untrusted Wasm as part of its design, any embedding application that loads attacker-supplied modules inherits the risk. The crash terminates the host process, disrupting any workload that depends on continuous Wasm execution.

Root Cause

The root cause is missing or insufficient validation around the memory access path used by the SIMD v128.store opcode. The runtime proceeds to a store operation that references memory in an invalid state, triggering a signal from the operating system. The upstream fix in WAMR 2.4.4 addresses the exceptional condition handling for this instruction path, as described in the GHSA-2f2p-wf5w-82qr advisory.

Attack Vector

An attacker crafts a WebAssembly module that invokes v128.store under conditions the runtime does not handle. The attacker delivers the module to a user or process that loads it into a vulnerable WAMR instance. Local access and user interaction are required, consistent with the CVSS vector AV:L/UI:R. The impact is limited to availability; confidentiality and integrity are not affected. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.188%.

Detection Methods for CVE-2025-64704

Indicators of Compromise

Unexpected SIGSEGV crashes in processes embedding iwasm or linking the WAMR library
Core dumps whose stack traces reference WAMR SIMD execution paths handling v128.store
Repeated abnormal termination of Wasm worker processes shortly after loading an untrusted module

Detection Strategies

Inventory all applications and firmware images that bundle WAMR and compare installed versions against 2.4.4
Monitor host logs and crash reporters for recurring faults in WAMR components, especially after Wasm module ingestion
Review build manifests and software bills of materials (SBOM) for the bytecodealliance:webassembly_micro_runtime component

Monitoring Recommendations

Enable kernel audit rules or EDR telemetry to capture segmentation faults in Wasm runtime processes
Log and retain hashes of all Wasm modules loaded by production services to support incident triage
Alert on repeated process restarts of services that execute untrusted Wasm workloads

How to Mitigate CVE-2025-64704

Immediate Actions Required

Upgrade WAMR to version 2.4.4 or later in all affected deployments and firmware images
Rebuild and redistribute any downstream products or containers that statically link WAMR
Restrict Wasm module ingestion to trusted, signed sources until patching completes

Patch Information

The maintainers released the fix in WAMR 2.4.4. Review the GitHub Security Advisory GHSA-2f2p-wf5w-82qr for the full remediation notes and affected code paths. Downstream projects embedding WAMR should pin to the patched release.

Workarounds

Disable loading of untrusted Wasm modules in applications that cannot be immediately upgraded
Run iwasm and other WAMR-based processes under service managers that auto-restart to limit availability impact
Isolate Wasm execution in sandboxed containers or dedicated low-privilege user accounts to contain crash impact

bash

# Verify the installed WAMR version and upgrade if below 2.4.4
iwasm --version

# Build the patched release from source
git clone https://github.com/bytecodealliance/wasm-micro-runtime.git
cd wasm-micro-runtime
git checkout WAMR-2.4.4
cd product-mini/platforms/linux
mkdir build && cd build
cmake ..
make