Executive brief
Binaryen is a compiler and toolchain library used for WebAssembly. A vulnerability in its parsing component allows a local attacker to provide malformed input that causes the software to crash. This results in a denial-of-service condition for applications or build processes relying on the library.
Technical details
A reachable assertion vulnerability (CWE-617) exists in WebAssembly Binaryen up to version 117 within the IRBuilder::makeBrOn function in src/wasm/wasm-ir-builder.cpp. The root cause is a failure to validate that certain types (ref and desc) are reference types before calling finalize(), which subsequently triggers an isRef() assertion failure in wasm::Type::getHeapType(). A local attacker can exploit this by providing specially crafted WebAssembly input to tools like wasm-ctor-eval. This results in an application crash (SIGABRT/IOT instruction). A patch has been released in commit 1251efbc1ea471c1311d2726b2bbe061ff2a291c which adds explicit type validation during parsing.
Affected products
- WebAssembly Binaryen up to 117
Timeline
- 2026-04-21: disclosed: Issue reported on GitHub repository
- 2026-04-21: patched: Fix merged via pull request 8635
- 2026-05-11: advisory: CVE-2026-8257 published
References
- https://github.com/HackC0der/CVE-Repos/blob/main/wasm-binaryen/Assertion_Failure_isRef_wasm_Type_getHeapType_commit_3ef8d19
- https://github.com/WebAssembly/binaryen/
- https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c
- https://github.com/WebAssembly/binaryen/issues/8633
- https://github.com/WebAssembly/binaryen/pull/8635
- https://vuldb.com/submit/809552
- https://vuldb.com/vuln/362554