CVE-2026-90648 WebAssembly CVE debrief

Who should care

Defenders and security teams using wasm2c or applications like Firefox, RLBox, and WasmBoxC should assess their exposure. This includes developers and administrators responsible for maintaining systems that utilize WebAssembly for sandboxing.

Why it matters

CVE-2026-90648 is a high-severity vulnerability in wasm2c that allows for sandbox escape and potential code execution. Defenders should prioritize assessing exposure in systems using wasm2c, especially those with 32-bit platforms or under specific memory conditions. Immediate actions include reviewing wasm2c configurations, ensuring memory safety limits are in place, and monitoring for exploitation attempts.

• Potential for arbitrary code execution in host process memory.
• Ability to bypass sandboxing mechanisms in wasm2c.
• Possible impact on applications using wasm2c for sandboxing, including Firefox.
• Need for verification of affected versions and remediation status.

Technical summary

The vulnerability occurs in wasm2c, part of WebAssembly wabt, due to a failure in checking the return value of calloc() in wasm_rt_allocate_funcref_table(). This leads to a 'table flip' attack, allowing arbitrary read and write of host process memory and potentially arbitrary code execution. The issue primarily affects 32-bit platforms and requires specific conditions to be exploited, such as memory pressure or address-space limits. wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is The fun

Defensive priority

Defenders should prioritize assessing exposure in systems using wasm2c, especially those with 32-bit platforms or under specific memory conditions. Immediate actions include reviewing wasm2c configurations, ensuring memory safety limits are in place, and monitoring for exploitation attempts.

Recommended defensive actions

• Assess exposure in systems using wasm2c, especially on 32-bit platforms.
• Review and adjust memory safety limits to prevent funcref table allocation failures.
• Monitor for exploitation attempts and implement additional logging and monitoring for wasm2c usage.
• Apply patches or updates for wasm2c and affected applications like Firefox.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced in commit ab9e0b55 (PR #813) of the WebAssembly wabt project. wasm2c's memory allocator aborts on calloc failure, but the table allocator lacks this abort behavior, leading to the vulnerability. The issue requires specific conditions to be exploited, such as memory pressure or address-space limits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.