CVE-2025-64704CWE-754

CVE-2025-64704

Medium · published November 26, 2025

CVSS v3.1

4.7

EPSS

Percentile

8.0

In the wild

Unconfirmed

What it is

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentation fault in v128.store instruction. This issue has been patched in version 2.4.4.

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00188 · 8.0th percentile
Weakness: CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published: 2025-11-26T04:15Z

Affected products (1)

Product	Versions	Fixed in
bytecodealliance/webassembly_micro_runtime	< 2.4.4	2.4.4

References (3)

https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.4 · [email protected]https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-2f2p-wf5w-82qr · [email protected]https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-2f2p-wf5w-82qr · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

25 NOV 22:06Z
WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
cvelistv5