7 matches found
CVE-2026-115893
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary...
CVE-2026-115893
The Wasmtime WebAssembly runtime is vulnerable to a sandbox escape on aarch64 engines using the default Cranelift backend. The issue occurs when processing a br_table instruction containing more than approximately 256,000 targets, causing an incorrect conditional branch target . This allows a use...
CVE-2026-115893
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary...
CVE-2026-49263
A flaw was found in Capstone, a disassembly framework, affecting its WebAssembly WASM backend. A remote attacker could exploit this by providing a specially crafted brtable instruction. This could lead to a denial of service, where the disassembler gets stuck in a loop, or cause parser...
AZL-95979 CVE-2026-49263 affecting package capstone 4.0.2-4
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...
AZL-96743 CVE-2026-49263 affecting package rust for versions less than 1.90.0-10
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...
EUVD-2026-58747
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...