CVE-2025-58749 WAMR runtime hangs or crashes with large memory.fill addresses in LLVM-JIT mode
Attackers can cause the WAMR runtime to hang or crash by providing WebAssembly programs with large memory.fill addresses in LLVM-JIT mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58749?
CVE-2025-58749 is a low-severity denial of service vulnerability in bytecodealliance wasm-micro-runtime, published on 16 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. In WAMR versions prior to 2.4.2, when running in LLVM-JIT mode, the runtime cannot exit normally when executing WebAssembly programs containing a memory.fill instruction where the first operand (memory address pointer) is greater than or equal to 2147483648 bytes (2GiB). This causes the runtime to hang in release builds or crash in debug builds due to accessing an invalid pointer. The issue does not occur in FAST-JIT mode or other runtime tools. This has been fixed in version 2.4.2.
Which versions are affected by CVE-2025-58749?
It affects 1 product.
Products include Bytecodealliance Webassembly Micro Runtime.
How do I fix CVE-2025-58749?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-58749 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58749 exists.
Other vulnerabilities in bytecodealliance wasm-micro-runtime
Sources
Also known as AZL-67608, AZL-67617, GHSA-xj5p-r8jq-pw47.