CVE-2023-48105 Memory corruption in n/a
A heap overflow in the wasm-micro-runtime library allows remote attackers to cause a denial of service via crafted bytecode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-48105?
CVE-2023-48105 is a high-severity memory corruption vulnerability in n/a, published on 22 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader.c.
Weakness: CWE-787
Which versions are affected by CVE-2023-48105?
It affects 1 product.
Products include Bytecodealliance Webassembly Micro Runtime.
How do I fix CVE-2023-48105?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-48105 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-48105 exists.
Other vulnerabilities in n/a
- CVE-2024-25431 Memory corruption in n/a
- CVE-2024-27532 Null dereference in n/a
- CVE-2024-34251 Memory corruption in n/a
- CVE-2025-43853 iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature
- CVE-2025-54126 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified
Sources
Also known as AZL-32060, GHSA-w252-369w-2g4v.