{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90648 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-90648 is a high-severity memory corruption vulnerability in WebAssembly wabt, published on 12 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90648 and fix it if it is affected.\n\nWhat it is: CVE-2026-90648 is a high-severity memory corruption vulnerability in WebAssembly wabt, published on 12 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90648 exists.\n\nAffected product: WebAssembly wabt. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90648/ (Markdown: https://insights.sbomify.com/CVE-2026-90648/index.md)","id":"CVE-2026-90648","markdown":"https://insights.sbomify.com/CVE-2026-90648/index.md","name":"CVE-2026-90648","record":{"aliases":["DEBIAN-CVE-2026-90648","GHSA-7jjw-49wp-pr5h","UBUNTU-CVE-2026-90648"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"WebAssembly sandbox library","requires_auth":"none","summary":"A missing calloc check in wasm2c allows sandbox escape and arbitrary code execution on 32-bit systems or under memory pressure, affecting applications like Firefox.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-252","name":"Unchecked Return Value"}],"description":"wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a \"table flip\" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table-\u003edata is left NULL while table-\u003esize keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Memory corruption in wabt","id":"CVE-2026-90648","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"MotoPress Hotel Booking \u003c= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'","id":"CVE-2026-90650"},"packages":[],"prev":{"headline":"Security feature bypass in ASE2000 V2 Communication Test Set","id":"CVE-2026-90647"},"products":["wabt"],"published":"2026-09-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-23","vendors":["WebAssembly"]},"summary":"A missing calloc check in wasm2c allows sandbox escape and arbitrary code execution on 32-bit systems or under memory pressure, affecting applications like Firefox.","url":"https://insights.sbomify.com/CVE-2026-90648/"}