A vulnerability tracked as CVE-2026-90648 affects wasm2c, part of the WebAssembly Binary Toolkit (wabt) through version 1.0.41, and can let sandboxed code break out of its intended confinement on 32-bit platforms, in what researchers call a 'table flip' bug. The flaw stems from code that fails to check whether a memory allocation for a function reference table succeeded; when that allocation silently fails, the table's recorded size no longer matches its actual empty contents, so later bounds checks pass incorrectly and let accesses land on arbitrary memory addresses. This effectively lets malicious WebAssembly modules escape the sandbox they're meant to run inside.
// source: nvd.nist.gov ↗