# CVE-2026-8257: WebAssembly Binaryen reachable assertion in BrOn Parser

Source: https://junglewise.ai/threats/cve-2026-8257-webassembly-binaryen-reachable-assertion-in-bron-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-8257 · Severity: low · CVSS 3.3 · Published 2026-05-11

Binaryen is a compiler and toolchain library used for WebAssembly. A vulnerability in its parsing component allows a local attacker to provide malformed input that causes the software to crash. This results in a denial-of-service condition for applications or build processes relying on the library.

Vendors: [WebAssembly](https://junglewise.ai/threats/vendors/webassembly).

## Quick answers

**Is CVE-2026-8257 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8257 being exploited in the wild.

**How severe is CVE-2026-8257?** Low severity, with a CVSS score of 3.3, published 11 May 2026.

**Which products and versions are affected?** WebAssembly Binaryen up to 117.

**Is there a fix for CVE-2026-8257?** A patch was published on 2026-04-21: Fix merged via pull request 8635 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8257 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-8257?** Check whether you run WebAssembly Binaryen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reachable assertion vulnerability (CWE-617) exists in WebAssembly Binaryen up to version 117 within the IRBuilder::makeBrOn function in src/wasm/wasm-ir-builder.cpp. The root cause is a failure to validate that certain types (ref and desc) are reference types before calling finalize(), which subsequently triggers an isRef() assertion failure in wasm::Type::getHeapType(). A local attacker can exploit this by providing specially crafted WebAssembly input to tools like wasm-ctor-eval. This results in an application crash (SIGABRT/IOT instruction). A patch has been released in commit 1251efbc1ea471c1311d2726b2bbe061ff2a291c which adds explicit type validation during parsing.

## Affected products

- WebAssembly Binaryen up to 117

## Timeline

- 2026-04-21: disclosed: Issue reported on GitHub repository
- 2026-04-21: patched: Fix merged via pull request 8635
- 2026-05-11: advisory: CVE-2026-8257 published

## References

- [https://github.com/HackC0der/CVE-Repos/blob/main/wasm-binaryen/Assertion_Failure_isRef_wasm_Type_getHeapType_commit_3ef8d19](https://github.com/HackC0der/CVE-Repos/blob/main/wasm-binaryen/Assertion_Failure_isRef_wasm_Type_getHeapType_commit_3ef8d19)
- [https://github.com/WebAssembly/binaryen/](https://github.com/WebAssembly/binaryen/)
- [https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c](https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c)
- [https://github.com/WebAssembly/binaryen/issues/8633](https://github.com/WebAssembly/binaryen/issues/8633)
- [https://github.com/WebAssembly/binaryen/pull/8635](https://github.com/WebAssembly/binaryen/pull/8635)
- [https://vuldb.com/submit/809552](https://vuldb.com/submit/809552)
- [https://vuldb.com/vuln/362554](https://vuldb.com/vuln/362554)