CVE-2026-58592
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. A JavaScript function imported into a WASM module via ESM causes a stack-local FunctionType to be destroyed after the link-loop iteration ends, while the host callback still references it, leading to memory corruption.
Risk Assessment
An attacker can exploit this vulnerability to achieve arbitrary write in the WebContent process memory, enabling code execution within the browser context. The risk includes control over the rendering process and potential access to user data.
Recommendation
Immediately update Ladybird to a version containing the fix for the dangling reference bug in WebAssemblyModule.cpp. Until the update, disable WebAssembly support in the browser.
Related vulnerabilities
- CVE-2026-85184Critical
In @fastify/middie versions >= 9.1.0 and before 9.3.4, the decision to run path-scoped middleware is made by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls.
- CVE-2026-82923Critical
The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.
- CVE-2026-85085Critical
The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
- CVE-2026-70403Critical
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
- CVE-2026-69657Critical
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
- CVE-2026-62928Critical
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
- CVE-2026-15354Critical
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
- CVE-2026-85509Critical
FreeIPMI before version 1.6.19 contains a stack-based buffer overflow in the _read_fru_data function in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
- CVE-2026-85508Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_ipv6_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-ipv6-info subcommand of dell get-system-info.
- CVE-2026-85507Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-info subcommand of dell get-system-info.
Original NVD description (English source)
Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to create_host_function, whose host callback captures and later reads that reference; once the ESM link-loop iteration ends the FunctionType is destroyed, leaving the callback with a dangling reference (the normal instantiate path uses a long-lived reference and is not affected). Stale result-type data lets the host callback return an empty result vector for a statically non-empty result, so the destination register retains an attacker-influenced value that is then consumed by the WASM-GC array.set handler, which bit-casts the reference low bits to an ArrayInstance pointer after only a null check, yielding an arbitrary write. A web page can chain this into code execution in the WebContent process. Verified reachable from HTML content without any instrumentation or source modification.