Log in Start free

Vulnerability · Published May 11, 2026 · Assigned by VulDB

CVE-2026-8257WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion

Low 3.3

In plain English

A low-severity security flaw in Binaryen from WebAssembly. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12binaryenno fix listedDEBIAN-CVE-2026-8257
Debian:13binaryenno fix listedDEBIAN-CVE-2026-8257
Debian:14binaryen130-2DEBIAN-CVE-2026-8257
Ubuntu:22.04:LTSbinaryenno fix listedUBUNTU-CVE-2026-8257
Ubuntu:24.04:LTSbinaryenno fix listedUBUNTU-CVE-2026-8257
Ubuntu:25.10binaryenno fix listedUBUNTU-CVE-2026-8257
Ubuntu:26.04:LTSbinaryenno fix listedUBUNTU-CVE-2026-8257
Ubuntu:26.10binaryenno fix listedUBUNTU-CVE-2026-8257

Affected products (as reported)

VendorProductVersions
WebAssembly Binaryen 117

Weakness: CWE-617 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References