Null-Dereference READ Vulnerability in WAMR Package
Summary
OSV-2026-169: Null-dereference READ in execute_post_instantiate_functions. Affects wamr versions >= 9a23968fdacc0df4ec7066bc19a412f8b7a8bd69, < 8d069c230c3cc83c622c4d338d84475ff15e3a00. Fixed in 8d069c230c3cc83c622c4d338d84475ff15e3a00. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WAMR (WebAssembly Micro Runtime) is a lightweight runtime for executing WebAssembly applications. It is designed for embedded systems and IoT devices, providing a minimal footprint while supporting a wide range of WebAssembly features. The package is widely used in environments where resource constraints are critical. However, it is susceptible to vulnerabilities that can lead to crashes or unexpected behavior, such as the null-dereference issue identified in this report.
Vulnerability Detail
The vulnerability arises from a null-dereference read in the function 'execute_post_instantiate_functions' within the WAMR package. This issue was reported through OSS-Fuzz, highlighting a crash state that occurs when the runtime attempts to access a null pointer during the instantiation of WebAssembly modules. If exploited, this vulnerability could lead to application crashes, potentially affecting the stability and security of systems relying on WAMR for WebAssembly execution.
How To Fix
Minimum fixed version
8d069c230c3cc83c622c4d338d84475ff15e3a00
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk of crashes.
Conclusion
In summary, the null-dereference read vulnerability in the WAMR package poses significant risks to applications utilizing this runtime. Users are encouraged to update to the patched version to mitigate potential crashes and ensure stability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for wamr →
FAQ
A null-dereference read occurs when a program attempts to access memory at a location that is null, leading to crashes or undefined behavior.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The potential impacts include application crashes, instability in systems using WAMR, and possible security risks if exploited by malicious actors.
While the primary concern is application crashes, depending on how the application handles state, there could be a risk of data loss if the application does not properly manage its state during a crash.
It is advisable to regularly check for vulnerabilities in your dependencies, ideally as part of your continuous integration/continuous deployment (CI/CD) pipeline, to ensure that you are using secure and stable versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for wamr.
