CVE-2026-90648
Received Received - Intake

Sandbox Escape in wabt via wasm2c Table Flip

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: MITRE

Description
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90648
EUVD
EUVD-2026-76923

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webassembly wabt *
webassembly wasm2c *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sandbox escape in wasm2c, a tool from the WebAssembly Binary Toolkit (WABT). When allocating memory for a function reference table fails, the table's data pointer becomes NULL but the size remains set. This allows bypassing bounds checks, treating table indices as absolute memory addresses. Attackers can then read or write host process memory, execute arbitrary code, and escape the sandbox. The flaw occurs in wasm_rt_allocate_funcref_table() due to missing return value checks from calloc().

Detection Guidance

Check if wasm2c is used in your applications, particularly in sandboxed environments like Firefox or RLBox. Inspect the version of wabt/wasm2c in use. On Linux, commands like 'dpkg -l | grep wabt' or 'rpm -qa | grep wabt' may help identify installed versions. Monitor for crashes or unexpected behavior in applications using wasm2c, especially under memory constraints.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary code on your system with the same privileges as the host application using wasm2c. This could lead to full system compromise, data theft, or installation of malware. It primarily affects 32-bit systems or environments with memory constraints where table allocation fails. Applications using wasm2c for sandboxing, like Firefox with certain libraries, are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches exposing personal or health information, leading to regulatory penalties, loss of compliance certifications, and reputational damage for organizations using affected applications.

Mitigation Strategies

Update to the latest version of wabt/wasm2c, as fixes have been upstreamed. For Firefox, ensure you are using version 114 or later. Replace RLBox's fork with the upstream wasm2c. Apply memory limits to prevent table allocation failures, such as setting 'ulimit -v' or adjusting 'vm.overcommit_memory'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart