Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) before 1.3.0 can have an double free or corruption error for a valid WebAssembly module because push_pop_frame_ref_offset is mishandled.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Webassembly_micro_runtime | Bytecodealliance | * | 1.3.0 (excluding) |