Executive brief
wasm2c is a code generator used by Firefox and other applications to sandbox untrusted code (such as font and media parsing libraries) by compiling WebAssembly to C. A memory allocation failure in the funcref table allocator can leave a critical data structure uninitialized, allowing attackers to read and write arbitrary memory and execute code, completely defeating the intended sandboxing protection. The vulnerability primarily affects 32-bit platforms or systems with constrained memory.
Technical details
wasm2c fails to check the return value of calloc() when allocating the funcref table in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When allocation fails, table->data remains NULL while table->size retains the guest-declared element count. This allows bounds checks to pass, causing table element accesses to resolve to arbitrary absolute memory addresses calculated as (i * sizeof(wasm_rt_funcref_t)). Attackers can exploit this via WebAssembly table.get, table.set, and call_indirect instructions to achieve arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the funcref table allocation to fail, which occurs under memory pressure, address-space limits, on 32-bit hosts, or with vm.overcommit_memory=2. On 64-bit Linux with default overcommit settings, allocations typically succeed. This defect was introduced in commit ab9e0b55 (PR #813).
Affected products
- WebAssembly wabt through 1.0.41
- Mozilla Firefox before 114
Timeline
- 2026-09-13: disclosed: CVE-2026-90648 published on NVD
- 2024: patched: Firefox 114 includes upstream wasm2c with fix