CVE-2026-8257
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In WebAssembly Binaryen up to version 117, the function IRBuilder::makeBrOn in src/wasm/wasm-ir-builder.cpp has a reachable assertion. Manipulation of input can cause a crash. The exploit is publicly available.
Risk Assessment
A local attacker can crash applications using Binaryen, potentially leading to denial of service.
Recommendation
Apply the patch identified as 1251efbc1ea471c1311d2726b2bbe061ff2a291c.
Original NVD description (English source)
A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.