PT-2026-39550 · Binaryen · Binaryen

Pwn3Rd · Published 2026-05-11 · Updated 2026-05-21 · CVE-2026-8257

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WebAssembly Binaryen versions prior to 118

Description An issue exists in the BrOn Parser component within the IRBuilder::makeBrOn() function of the src/wasm/wasm-ir-builder.cpp file. A specific manipulation can lead to a reachable assertion, which is a condition where the program reaches a state that the developers assumed was impossible, typically causing the application to crash. This requires local access to be exploited.

Recommendations Install the patch 1251efbc1ea471c1311d2726b2bbe061ff2a291c to resolve this issue.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-8257

Affected Products

Binaryen

References · 19

• 🔥 https://github.com/WebAssembly/binaryen/issues/8633 · Exploit
• 🔥 https://github.com/HackC0der/CVE-Repos/blob/main/wasm-binaryen/Assertion_Failure_isRef_wasm_Type_getHeapType_commit_3ef8d19 · Exploit
• https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c · Patch
• https://github.com/WebAssembly/binaryen/pull/8635 · Patch
• https://ubuntu.com/security/CVE-2026-8257 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8257 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8257 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8257 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8257 · Security Note
• https://t.me/cveNotify/164422 · Telegram Post
• https://github.com/WebAssembly/binaryen · Note
• https://vuldb.com/vuln/362554 · Note
• https://vuldb.com/submit/809552 · Note
• https://twitter.com/CVEnew/status/2053954522305691854 · Twitter Post