CVE-2026-8257

MediumCVSS 5.5/10Last modified Jul 23, 2026

Description

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
WebAssembly	Binaryen	117

References

https://github.com/HackC0der/CVE-Repos/blob/main/wasm-binaryen/Assertion_Failure_isRef_wasm_Type_getHeapType_commit_3ef8d19Exploit
https://github.com/WebAssembly/binaryen/Product
https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291cPatch
https://github.com/WebAssembly/binaryen/issues/8633Exploit, Issue Tracking, Third Party Advisory
https://github.com/WebAssembly/binaryen/pull/8635Mitigation, Patch
https://vuldb.com/submit/809552Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362554Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362554/ctiPermissions Required, VDB Entry

Timeline

Published: May 11, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-825787.5When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no CVE-2026-825796.0Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's outp CVE-2026-82585.3A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a m CVE-2026-825805.3Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users CVE-2026-825825.3An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retriev CVE-2026-825838.3NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector CVE-2026-825842.3Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to f CVE-2026-825856.5The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of in CVE-2026-825868.2Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not CVE-2026-825874.3A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of th CVE-2026-825884.3A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the CVE-2026-825894.3A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file