CVE-2026-90648 | CVSS: N/A
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and – via table.get
参考链接:
• https://bugzilla.mozilla.org/show_bug.cgi?id=1827704
• https://github.com/WebAssembly/wabt
• https://github.com/trustsig-eu/wasm2c-tableflip
📌 数据来源: NVD 官方