CVE-2023-52284

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bytecodealliance/wasm-micro-runtime/compare/WAMR-1.2.3...WAMR-1.3.0Patch
https://github.com/bytecodealliance/wasm-micro-runtime/issues/2586Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/bytecodealliance/wasm-micro-runtime/pull/2590Patch
https://github.com/bytecodealliance/wasm-micro-runtime/compare/WAMR-1.2.3...WAMR-1.3.0Patch
https://github.com/bytecodealliance/wasm-micro-runtime/issues/2586Exploit, Issue Tracking, Patch, Vendor Advisory
https://github.com/bytecodealliance/wasm-micro-runtime/pull/2590Patch

Timeline

Published: Dec 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-522857.5ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.CVE-2023-522867.5Tencent tdsqlpcloud through 1.8.5 allows unauthenticated remote attackers to discover database credentials via an index.php/api/install/get_CVE-2023-522887.5An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET re CVE-2023-522897.5An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST r CVE-2023-52294.8The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perfo CVE-2023-522908.1In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to th CVE-2023-522914.7In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attack CVE-2023-522925.4IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to stored cross-site scripting. This vulnerabili CVE-2023-522965.3IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service when querying a specific UDF built CVE-2023-52305.4The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcod CVE-2023-523027.5Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.CVE-2023-523037.5Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.