Vulnerability in wasm2c of WebAssembly by WABT allowing arbitrary code execution

CVE-2026-90648

What is CVE-2026-90648?

The vulnerability in wasm2c of WABT allows for a sandbox escape through a flaw in memory allocation handling on certain platforms, particularly 32-bit systems. When the allocation of the funcref table fails, the internal state leads to a scenario where bounds checks pass, permitting unauthorized read and write operations to the host's memory. This flaw could be exploited when specific system constraints such as address-space limits or memory pressure are encountered, resulting in arbitrary code execution. Applications leveraging wasm2c to sandbox untrusted input, such as Firefox including its libraries, could be adversely impacted. This defect highlights critical memory management oversights that undermine the intended isolation features of the WebAssembly runtime.

References