A critical sandbox escape vulnerability in WebAssembly wabt allows attackers to execute arbitrary code on the host system by triggering a failed memory allocation, posing a severe risk to applications relying on wasm2c for isolation.

This vulnerability involves an unchecked return value from the calloc function within the wasm_rt_allocate_funcref_table implementation. When memory allocation fails, the table pointer remains NULL while the size remains populated, allowing an attacker to bypass bounds checks and perform arbitrary read and write operations on host process memory.

The successful exploitation of this flaw defeats the core security boundary provided by wasm2c, which is used by critical software like Firefox to isolate untrusted content. An attacker can achieve arbitrary code execution on the host, leading to full system compromise, data theft, and loss of service. Given the CVSS score of 7.1, this vulnerability represents a high-severity risk that could be leveraged to break out of sandboxed environments.

Immediate Action: Update the wabt toolkit to a version containing the fix for this issue (commit 03a00a1334e6121fb0cce4fccbd6bb109b68acaa). Organizations embedding wasm2c must rebuild their applications with the patched version of the library.

Proactive Monitoring: Monitor system logs for unexpected process terminations or memory allocation errors occurring within sandboxed WebAssembly execution environments.

Compensating Controls: Ensure host systems enforce strict memory limits and address space constraints, although these are primary triggers for the vulnerability and should be considered temporary measures until patching is complete.

Public Exploit Available: Yes, a functional proof-of-concept exists as detailed in the research write-up by trustsig-eu (https://github.com/trustsig-eu/wasm2c-tableflip).

This vulnerability represents a fundamental failure in the isolation mechanism of the wasm2c sandbox. Given the availability of a public proof-of-concept and the potential for remote code execution within critical applications, organizations must prioritize updating their dependencies to the latest version of wabt immediately. Failure to patch will leave host systems vulnerable to complete compromise via untrusted WebAssembly modules.