Threats tagged 'ghsa-7jjw-49wp-pr5h'

CVE-2026-90648 is a high-severity vulnerability in the wasm2c tool of WebAssembly wabt up to version 1.0.41. It involves an unchecked return value from calloc() in the function wasm_rt_allocate_funcref_table(), which can lead to a sandbox escape on primarily 32-bit platforms. When allocation fails, the funcref table's data pointer is left NULL but size remains nonzero, causing bounds checks to pass incorrectly and allowing arbitrary memory read/write and code execution in the host process. This affects sandboxing boundaries used by RLBox and WasmBoxC, including Firefox components that use wasm2c for untrusted input containment. Exploitation requires specific memory pressure conditions or restrictive memory overcommit settings. The vulnerability does not trigger on 64-bit Linux with default overcommit settings.