Wave Language Security Advisories

Security updates and advisories for Wave Language


Incorrect Pointer Dereference Store Code Generation

ID: WLSA-2026-0001

Date: 2026-05-18

Severity: Critical


A critical code generation bug exists in Wave's pointer dereference assignment handling.

When compiling code using:

deref p = value;

the compiler may incorrectly write to the local stack slot containing the pointer variable itself instead of the memory pointed to by the pointer.

Impact

This issue may affect:

  • Operating system kernels
  • UEFI bootloaders
  • Memory allocators
  • Drivers
  • Runtime systems
  • FFI code

The issue was discovered during WaveOS development.

Affected Versions

All versions up to and including:

  • 0.1.8-pre-beta

may be affected.

Root Cause

Incorrect lvalue address resolution during dereference assignment code generation.

Status

Fix in progress.