WebAssembly

Products

Exploited and recent CVEs

• CVE-2026-90648 High 7.1 wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in 0.2%
• CVE-2026-8257 Low 3.3 WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion 0.2%
• CVE-2025-15412 Medium 5.3 WebAssembly wabt wasm-decompile VarName out-of-bounds 0.2%
• CVE-2025-15411 Medium 5.3 WebAssembly wabt wasm-decompile InsertNode memory corruption 0.2%
• CVE-2025-14957 Low 3.3 WebAssembly Binaryen IRBuilder wasm-ir-builder.cpp makeLocalTee null pointer dereference 0.2%
• CVE-2025-14956 Medium 5.3 WebAssembly Binaryen wasm-binary.cpp readExport heap-based overflow 0.2%
• CVE-2025-6275 Low 3.3 WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free 0.2%
• CVE-2025-6274 Low 3.3 WebAssembly wabt binary-reader-interp.cc OnDataCount resource consumption 0.2%
• CVE-2025-6273 Low 3.3 WebAssembly wabt binary-reader-objdump.cc LogOpcode assertion 0.2%
• CVE-2025-3122 Low 3.1 WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference 0.6%
• CVE-2025-2584 Medium 5.0 WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow 0.5%
• CVE-2025-2368 Medium 6.3 WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflow 0.6%