Is CVE-2026-8257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8257 being exploited in the wild.

How severe is CVE-2026-8257?

Low severity, with a CVSS score of 3.3, published 11 May 2026.

Which products and versions are affected?

WebAssembly Binaryen up to 117.

Is there a fix for CVE-2026-8257?

A patch was published on 2026-04-21: Fix merged via pull request 8635 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8257 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-8257?

Check whether you run WebAssembly Binaryen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8257: WebAssembly Binaryen reachable assertion in BrOn Parser

CVE-2026-8257 · Severity: low · CVSS 3.3 · Published 2026-05-11

Binaryen is a compiler and toolchain library used for WebAssembly. A vulnerability in its parsing component allows a local attacker to provide malformed input that causes the software to crash. This results in a denial-of-service condition for applications or build processes relying on the library.

Vendors: WebAssembly.

Quick answers

Is CVE-2026-8257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8257 being exploited in the wild.
How severe is CVE-2026-8257?: Low severity, with a CVSS score of 3.3, published 11 May 2026.
Which products and versions are affected?: WebAssembly Binaryen up to 117.
Is there a fix for CVE-2026-8257?: A patch was published on 2026-04-21: Fix merged via pull request 8635 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8257 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-8257?: Check whether you run WebAssembly Binaryen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reachable assertion vulnerability (CWE-617) exists in WebAssembly Binaryen up to version 117 within the IRBuilder::makeBrOn function in src/wasm/wasm-ir-builder.cpp. The root cause is a failure to validate that certain types (ref and desc) are reference types before calling finalize(), which subsequently triggers an isRef() assertion failure in wasm::Type::getHeapType(). A local attacker can exploit this by providing specially crafted WebAssembly input to tools like wasm-ctor-eval. This results in an application crash (SIGABRT/IOT instruction). A patch has been released in commit 1251efbc1ea471c1311d2726b2bbe061ff2a291c which adds explicit type validation during parsing.

Affected products

WebAssembly Binaryen up to 117

Timeline

2026-04-21: disclosed: Issue reported on GitHub repository
2026-04-21: patched: Fix merged via pull request 8635
2026-05-11: advisory: CVE-2026-8257 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.