WebAssembly has 4 CVEs on record. 1 was published in the last 90 days. The median CVSS is 5.3 (medium). Most affected products: wabt (3), binaryen (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Worst active — by depth score
CVE-2026-90648High· 7.1wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack51CVE-2025-15412Medium· 5.3A security vulnerability has been detected in WebAssembly wabt up to 1.0.3929CVE-2025-15411Medium· 5.3A weakness has been identified in WebAssembly wabt up to 1.0.3929CVE-2026-8257Low· 3.3A vulnerability was detected in WebAssembly Binaryen up to 11718
WebAssembly vulnerabilities
CVEs affecting WebAssembly, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-90648High· 7.1PoCwasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack
wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wa…
CVE-2026-8257Low· 3.3A vulnerability was detected in WebAssembly Binaryen up to 117
A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable ass…
CVE-2025-15412Medium· 5.3A security vulnerability has been detected in WebAssembly wabt up to 1.0.39
A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. Such manipulation lead…
CVE-2025-15411Medium· 5.3A weakness has been identified in WebAssembly wabt up to 1.0.39
A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memor…