The vulnerability CVE-2026-90648 in wasm2c of WebAssembly wabt (<=1.0.41) arises from failure to check the return value of calloc() in wasm_rt_allocate_funcref_table(). On allocation failure, the funcref table's data pointer is left NULL while its size remains set, allowing bounds checks to pass incorrectly. This leads to out-of-bounds table element accesses that map to absolute host memory addresses, enabling arbitrary read/write and code execution via table.get, table.set, and call_indirect instructions. This bypasses the sandbox isolation intended by wasm2c. The flaw primarily affects 32-bit platforms or environments with strict memory limits (e.g., RLIMIT_AS, vm.overcommit_memory=2). The defect was introduced in commit ab9e0b55 (PR #813). wasm2c is used as an in-process sandbox by RLBox and WasmBoxC, including in Firefox for isolating untrusted font, media, and XML processing.

Successful exploitation allows an attacker to escape the wasm2c sandbox and achieve arbitrary read and write access to the host process memory, potentially leading to arbitrary code execution. This compromises the isolation guarantees of wasm2c, affecting applications relying on it for sandboxing untrusted code, such as Firefox components using RLBox and WasmBoxC. The vulnerability is conditional on allocation failure, which is more likely on 32-bit platforms or under memory pressure with strict memory overcommit policies. On 64-bit Linux with default memory overcommit, the vulnerability is not triggered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigating conditions that cause calloc() to fail (such as strict address space limits or disabling memory overcommit) may reduce the risk of exploitation. Monitoring and controlling memory pressure on affected systems can also help. Users should track official WebAssembly wabt advisories for updates and apply patches once released.