Is CVE-2026-90648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90648 being exploited in the wild.

How severe is CVE-2026-90648?

Informational severity, with a CVSS score of 7.5, published 13 September 2026.

Which products and versions are affected?

Mozilla Firefox before 114; WebAssembly Wabt through 1.0.41.

Is there a fix for CVE-2026-90648?

A patch was published on 2024: Firefox 114 includes upstream wasm2c with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90648 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90648?

Check whether you run Mozilla Firefox or WebAssembly Wabt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90648: WebAssembly wabt wasm2c sandbox escape via table fli

CVE-2026-90648 · Severity: info · CVSS 7.5 · Published 2026-09-13

wasm2c is a code generator used by Firefox and other applications to sandbox untrusted code (such as font and media parsing libraries) by compiling WebAssembly to C. A memory allocation failure in the funcref table allocator can leave a critical data structure uninitialized, allowing attackers to read and write arbitrary memory and execute code, completely defeating the intended sandboxing protection. The vulnerability primarily affects 32-bit platforms or systems with constrained memory.

Technologies: Mozilla Firefox, WebAssembly Wabt. Vendors: Mozilla, WebAssembly.

Quick answers

Is CVE-2026-90648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90648 being exploited in the wild.
How severe is CVE-2026-90648?: Informational severity, with a CVSS score of 7.5, published 13 September 2026.
Which products and versions are affected?: Mozilla Firefox before 114; WebAssembly Wabt through 1.0.41.
Is there a fix for CVE-2026-90648?: A patch was published on 2024: Firefox 114 includes upstream wasm2c with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90648 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90648?: Check whether you run Mozilla Firefox or WebAssembly Wabt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

wasm2c fails to check the return value of calloc() when allocating the funcref table in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When allocation fails, table->data remains NULL while table->size retains the guest-declared element count. This allows bounds checks to pass, causing table element accesses to resolve to arbitrary absolute memory addresses calculated as (i * sizeof(wasm_rt_funcref_t)). Attackers can exploit this via WebAssembly table.get, table.set, and call_indirect instructions to achieve arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the funcref table allocation to fail, which occurs under memory pressure, address-space limits, on 32-bit hosts, or with vm.overcommit_memory=2. On 64-bit Linux with default overcommit settings, allocations typically succeed. This defect was introduced in commit ab9e0b55 (PR #813).

Affected products

WebAssembly wabt through 1.0.41
Mozilla Firefox before 114

Timeline

2026-09-13: disclosed: CVE-2026-90648 published on NVD
2024: patched: Firefox 114 includes upstream wasm2c with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.