CVE-2026-8257 MEDIUM

CVE-2026-8257: WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion

Vendor Webassembly
Product Binaryen
Weakness CWE-617
Published May 11, 2026
Last update May 11, 2026

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.

Key dates

02Disclosure timeline

May 11, 2026 CVE published
May 11, 2026 Record updated