2435 matches found
CVE-2026-74936-gc-potato
CVE-2026-74936 一个并不精致的复现。基线部分需要一些调整。 Mozilla 将此问题描述为 WebAssembly 释放后使用（use-after-free）。公开修复 9823b5c86ffa 在 JitActivation 中保持精确捕获的 wasm::Code 存活。 该测试执行了一次错误签名的跨实例尾调用。当引擎处理陷阱时，一个 Debugger 展开钩子清除了表中最后一个目标引用，并强制进行收缩式 GC。在进入尾调用之前，Wasm 调用了一个打印标记的普通 JavaScript 导入。 结果 修复前父版本 9b564f641a42：状态 139（SIGSEGV）。...
CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion
CVE-2026-21001 – 通过表索引混淆导致的 WebAssembly 线性内存越界访问 概述 WebAssembly 模块使用了一个导入函数，该函数对数组索引没有边界检查。攻击者可以提供越界索引，在线性内存之外进行读取或写入，从而可能泄露宿主机密或在 WASM 运行时中实现代码执行。 漏洞详情 类型： 越界访问（WASM） 影响： 宿主机内存破坏，在某些运行时中可导致 RCE。 根本原因： Rust unsafe 代码在偏移原始指针时未将索引限制在数组长度范围内。 漏洞利用演示 1. 将 Rust 代码编译为 WASM： root@kitploit: rustup target...
gato
!WARNING This repository is deprecated and archived Gato has been superseded by Trajan , Praetorian's multi-platform CI/CD vulnerability detection and attack automation tool. Trajan consolidates GitHub Actions Gato and GitLab Glato CI/CD attack capabilities into a single, actively-maintained...
octopus
Octopus Huge thanks to QuoScient for having sponsored this project. Octopus is a security analysis framework for WebAssembly module and Blockchain Smart Contract. The purpose of Octopus is to provide an easy way to analyze closed-source WebAssembly module and smart contracts bytecode to understan...
EUVD-2026-81605
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...
CVE-2026-92040
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...
toy-wasm-symbexp
toy-wasm-symbexp This is a toy WASM symbolic interpreter. It illustrates the following articles: Part 1 - Introduction Part 2 - Writing a concrete interpreter - browse code at this stage Part 3 - Writing a symbolic interpreter - browse code at this stage Part 4 - Writing a symbolic interpreter...
Linux Distros Unpatched Vulnerability : CVE-2026-92040
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92040 Note that Nessus relies...
CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerab...
UBUNTU-CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerab...
CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
EUVD-2026-78503
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92040
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
CVE-2026-92040
CVE-2026-92040 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Mozilla products. It was fixed in Firefox 156 and Thunderbird 156 (per Mozilla Foundation Security Advisory mfsa2026-94). CISA's SSVC assessment rates exploitation as none , automatability as no , and tec...
PT-2026-91976
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...
Astra Linux – Vulnerability in Firefox and Thunderbird
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...
Astra Linux – Vulnerability in Firefox
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...
Astra Linux – Vulnerability in Firefox and Thunderbird
Inconsistent data in the instruction and data cache when creating Wasm code can lead to a potentially exploitable crash.This bug only affects Firefox on ARM64 platforms.. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...