# CVE-2026-90648: WebAssembly wabt wasm2c sandbox escape via table fli

Source: https://junglewise.ai/threats/cve-2026-90648-webassembly-wabt-wasm2c-sandbox-escape-via-table-fli  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90648 · Severity: info · CVSS 7.5 · Published 2026-09-13

wasm2c is a code generator used by Firefox and other applications to sandbox untrusted code (such as font and media parsing libraries) by compiling WebAssembly to C. A memory allocation failure in the funcref table allocator can leave a critical data structure uninitialized, allowing attackers to read and write arbitrary memory and execute code, completely defeating the intended sandboxing protection. The vulnerability primarily affects 32-bit platforms or systems with constrained memory.

Technologies: [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox), [WebAssembly Wabt](https://junglewise.ai/threats/technologies/wabt). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla), [WebAssembly](https://junglewise.ai/threats/vendors/webassembly).

## Quick answers

**Is CVE-2026-90648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90648 being exploited in the wild.

**How severe is CVE-2026-90648?** Informational severity, with a CVSS score of 7.5, published 13 September 2026.

**Which products and versions are affected?** Mozilla Firefox before 114; WebAssembly Wabt through 1.0.41.

**Is there a fix for CVE-2026-90648?** A patch was published on 2024: Firefox 114 includes upstream wasm2c with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90648 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90648?** Check whether you run Mozilla Firefox or WebAssembly Wabt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

wasm2c fails to check the return value of calloc() when allocating the funcref table in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When allocation fails, table->data remains NULL while table->size retains the guest-declared element count. This allows bounds checks to pass, causing table element accesses to resolve to arbitrary absolute memory addresses calculated as (i * sizeof(wasm_rt_funcref_t)). Attackers can exploit this via WebAssembly table.get, table.set, and call_indirect instructions to achieve arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the funcref table allocation to fail, which occurs under memory pressure, address-space limits, on 32-bit hosts, or with vm.overcommit_memory=2. On 64-bit Linux with default overcommit settings, allocations typically succeed. This defect was introduced in commit ab9e0b55 (PR #813).

## Affected products

- WebAssembly wabt through 1.0.41
- Mozilla Firefox before 114

## Timeline

- 2026-09-13: disclosed: CVE-2026-90648 published on NVD
- 2024: patched: Firefox 114 includes upstream wasm2c with fix

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=1827704](https://bugzilla.mozilla.org/show_bug.cgi?id=1827704)
- [https://github.com/WebAssembly/wabt](https://github.com/WebAssembly/wabt)

## Related threats

- [Firefox privilege escalation in Nimbus Desktop Client](https://junglewise.ai/threats/cve-2026-124951-privilege-escalation-in-the-nimbus-desktop-client-component-this)
- [Firefox same-origin policy bypass in CSS Parsing and Computation](https://junglewise.ai/threats/cve-2026-124950-same-origin-policy-bypass-in-the-css-parsing-and-computation)
- [Firefox other issue in SVG component](https://junglewise.ai/threats/cve-2026-124949-other-issue-in-the-svg-component-this-vulnerability-was-fixed-in)
- [Mozilla Firefox use-after-free in Graphics component](https://junglewise.ai/threats/cve-2026-124948-incorrect-boundary-conditions-use-after-free-in-the-graphics)
- [Firefox incorrect boundary conditions in Graphics component](https://junglewise.ai/threats/cve-2026-124947-incorrect-boundary-conditions-in-the-graphics-component-this)