ANT-2026-669BEQ2W · bytecodealliance/wasm-micro-runtime

heap-buffer-overflow low

Severity Claude low · Security research firm low · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-669BEQ2W: Integer overflow in array.new size calculation leading to heap buffer overflow via signed-to-unsigned wrap-around in GC instruction

Signed-to-unsigned integer wrap-around in the array.new size calculation produces an undersized allocation, causing a heap buffer overflow.

Target

Project: WAMR
Location: array.new (GC instruction)
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The size calculation for the array.new GC instruction performs a signed-to-unsigned conversion that can wrap around. When the computed size overflows, the allocator receives a smaller value than required, and subsequent writes to the array overrun the heap buffer.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-669BEQ2W.

Reference: ANT-2026-669BEQ2W
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: true positive
Severity: low

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-05-07 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-05-28 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

81ac0c092278af7ebf4b8ca82a54db16c9d472978e79d90ed3a005260f299a8b716e406955c04a8eded32b02f9c9e5885959cafcb81c1fe1e228844b9eb2efd2

Committed 2026-05-07 00:01 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-669BEQ2W",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "low",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:30+00:00",
  "description": "Signed-to-unsigned integer wrap-around in the array.new size calculation produces an undersized allocation, causing a heap buffer overflow.",
  "discovered_at": null,
  "location": "array.new (GC instruction)",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "WAMR",
  "reproduction": null,
  "technical_details": "The size calculation for the array.new GC instruction performs a signed-to-unsigned conversion that can wrap around. When the computed size overflows, the allocator receives a smaller value than required, and subsequent writes to the array overrun the heap buffer.",
  "title": "Integer overflow in array.new size calculation leading to heap buffer overflow via signed-to-unsigned wrap-around in GC instruction",
  "vendor_severity": "low"
}