Unrated

DEBIAN-CVE-2026-8257

Type: advisorySource: OSV1 source record

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The exploit is now public and may be used. The patch is named 1251efbc1ea471c1311d2726b2bbe061ff2a291c. It is suggested to install a patch to address this issue.

Announced 11 May 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-8257

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-8257

binaryen

Source reference: /affected/0/package/name

Affected versions: 108-1
Source reference: /affected/0/versions
112-1
Source reference: /affected/0/versions
116-1
Source reference: /affected/0/versions
120-1
Source reference: /affected/0/versions
120-2
Source reference: /affected/0/versions
120-3
Source reference: /affected/0/versions
120-4
Source reference: /affected/0/versions
120-4+ports
Source reference: /affected/0/versions
122-1.1
Source reference: /affected/0/versions
122-2
Source reference: /affected/0/versions
122-3
Source reference: /affected/0/versions
130-1
Source reference: /affected/0/versions
130-2
Source reference: /affected/0/versions
130-3
Source reference: /affected/0/versions
131-1
Source reference: /affected/0/versions
131-2
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

binaryen

Source reference: /affected/1/package/name

Affected versions: 120-4
Source reference: /affected/1/versions
120-4+ports
Source reference: /affected/1/versions
122-1.1
Source reference: /affected/1/versions
122-2
Source reference: /affected/1/versions
122-3
Source reference: /affected/1/versions
130-1
Source reference: /affected/1/versions
130-2
Source reference: /affected/1/versions
130-3
Source reference: /affected/1/versions
131-1
Source reference: /affected/1/versions
131-2
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

binaryen

Source reference: /affected/2/package/name

Affected versions: 120-4
Source reference: /affected/2/versions
120-4+ports
Source reference: /affected/2/versions
122-1.1
Source reference: /affected/2/versions
122-2
Source reference: /affected/2/versions
122-3
Source reference: /affected/2/versions
130-1
Source reference: /affected/2/versions
130-2
Source reference: /affected/2/versions
130-3
Source reference: /affected/2/versions
131-1
Source reference: /affected/2/versions
131-2
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "binaryen",
      "purl": "pkg:deb/debian/binaryen?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "108-1",
      "112-1",
      "116-1",
      "120-1",
      "120-2",
      "120-3",
      "120-4",
      "120-4+ports",
      "122-1.1",
      "122-2",
      "122-3",
      "130-1",
      "130-2",
      "130-3",
      "131-1",
      "131-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8257.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "binaryen",
      "purl": "pkg:deb/debian/binaryen?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "120-4",
      "120-4+ports",
      "122-1.1",
      "122-2",
      "122-3",
      "130-1",
      "130-2",
      "130-3",
      "131-1",
      "131-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8257.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "binaryen",
      "purl": "pkg:deb/debian/binaryen?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "120-4",
      "120-4+ports",
      "122-1.1",
      "122-2",
      "122-3",
      "130-1",
      "130-2",
      "130-3",
      "131-1",
      "131-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8257.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #58247 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:49:24 GMT
Publisher date: Mon, 11 May 2026 02:16:27 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-8257 · Revision 1Source updated