CVE-2026-90648: High severity wasm2c (WABT) vulnerability
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasmrtallocatefuncreftable() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i sizeof(wasmrtfuncreft)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and callindirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMITAS), on 32-bit hosts, with vm.overcommitmemory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not use vm.overcommit_memory=2 on affected 32-bit hosts / under memory pressure scenarios, since the funcref table allocation failure condition enables the described sandbox escape.
Linux kernel vm.overcommit_memory = 2 - Compensating control
Apply/strengthen sandboxing around in-process wasm2c/RLBox/WasmBoxC usage (e.g., run the wasm2c-containing workloads in an external sandbox/isolated process boundary) because the vulnerability allows sandbox escape when the funcref table allocation fails.
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Deployments that use wasm2c as an in-process sandboxing boundary are potentially affected, including RLBox and WasmBoxC deployments. Firefox uses wasm2c to contain Graphite, Hunspell, Ogg, Expat, and Woff2 when processing untrusted font, media, and XML input.
What conditions are needed for exploitation?
Exploitation requires allocation of a function-reference table to fail while its guest-declared size remains nonzero. The described conditions that can cause this include address-space limits such as RLIMIT_AS, 32-bit hosts, and systems with vm.overcommit_memory=2.
Why does an allocation failure become a sandbox escape?
After calloc() fails, the table data pointer remains NULL but the table size still permits bounds checks to pass. Table operations can then access addresses derived from the element index, enabling host-process memory reads and writes and potentially arbitrary code execution through call_indirect.