Description
A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WebAssembly | Binaryen | 117 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | binaryen | 130-2 | — |
| Debian 13 | binaryen | No fix yet | — |
| Debian 12 | binaryen | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | binaryen | No fix yet | — |
| Ubuntu 26.04 LTS | binaryen | No fix yet | — |
| Ubuntu 25.10 | binaryen | No fix yet | — |
| Ubuntu 24.04 LTS | binaryen | No fix yet | — |
| Ubuntu 22.04 LTS | binaryen | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | binaryen | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | binaryen | 133-1.1 | openSUSE-SU-2026:11915-1 |
Advisories 1
- openSUSE-SU-2026:11915-1 binaryen-133-1.1 on GA media SUSE / openSUSE Security Updates · Sep 30, 2026
References
- VDB-362554 | WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion vdb-entry technical-description
- VDB-362554 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #809552 | WebAssembly Community Binaryen main branch commit 3ef8d19 (v117 development version, vulnerable version before fix commit 1251efb) Fixed version: commit 1251ef Assertion Failure, Denial of Service (Local DoS) third-party-advisory
- https://github.com/WebAssembly/binaryen/issues/8633 issue-tracking
- https://github.com/WebAssembly/binaryen/pull/8635 issue-tracking patch
- https://github.com/HackC0der/CVE-Repos/blob/main/wasm-binaryen/Assertion_Failure_isRef_wasm_Type_getHeapType_commit_3ef8d19 exploit patch
- https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c patch
- https://github.com/WebAssembly/binaryen/ product