EUVD-2026-41130
GHSA-vm9p-mx69-hf3f
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via web page (AV:N) with no privileges (PR:N) but victim must visit a page (UI:R) and precise heap/timing control is needed (AC:H); renderer memory corruption crossing into process code execution justifies S:C and full C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to create_host_function, whose host callback captures and later reads that reference; once the ESM link-loop iteration ends the FunctionType is destroyed, leaving the callback with a dangling reference (the normal instantiate path uses a long-lived reference and is not affected). Stale result-type data lets the host callback return an empty result vector for a statically non-empty result, so the destination register retains an attacker-influenced value that is then consumed by the WASM-GC array.set handler, which bit-casts the reference low bits to an ArrayInstance pointer after only a null check, yielding an arbitrary write. A web page can chain this into code execution in the WebContent process. Verified reachable from HTML content without any instrumentation or source modification.
AnalysisAI
Reachable code execution in the Ladybird browser arises from a dangling-reference flaw (CWE-825) in the WebAssembly ESM-integration module loader, where a stack-local Wasm::FunctionType is captured by reference and read after destruction. A malicious web page can chain the resulting stale result-type data into an arbitrary write via the WASM-GC array.set handler and gain code execution in the WebContent process. Reported by VulnCheck with publicly available exploit code exists; it is not listed in CISA KEV, so no confirmed active exploitation, but a working PoC lowers the barrier for weaponization.
Technical ContextAI
The defect lives in Ladybird's LibWeb WebAssembly implementation (WebAssemblyModule.cpp), specifically the ESM (ECMAScript Module) integration path that lets JavaScript functions be imported into a WebAssembly module. During ESM link-loop iteration, a stack-local Wasm::FunctionType is passed by reference into create_host_function; the generated host callback captures that reference and reads it after the FunctionType object goes out of scope and is destroyed at the end of the iteration - a classic expired-pointer / use-of-freed-reference condition (CWE-825). The normal instantiate path is unaffected because it uses a long-lived reference. The stale result-type metadata causes the host callback to return an empty result vector for a statically non-empty result signature, leaving an attacker-influenced value in the destination register. That value is then consumed by the WASM-GC array.set handler, which bit-casts the reference's low bits directly to an ArrayInstance pointer after only a null check, producing an arbitrary write primitive that is escalated to control flow. The single affected CPE is cpe:2.3:a:ladybirdbrowser:ladybird, an independent, from-scratch browser engine.
RemediationAI
No vendor-released patch version is identified in the available data; the references point only to the vulnerable source file on the master branch and the VulnCheck advisory, so users should upgrade to the latest Ladybird build once the maintainers publish a fix that removes the dangling FunctionType reference (track https://github.com/LadybirdBrowser/ladybird and the advisory at https://www.vulncheck.com/advisories/ladybird-web-reachable-code-execution-via-dangling-functiontype-reference-in-webassembly-esm-integration for the fixed commit/tag, and rebuild from source). Until a patched build is confirmed, the most effective compensating control is to avoid using Ladybird for general web browsing of untrusted content, since the bug is reachable from ordinary HTML; where the engine must run, restrict it to trusted sites only. If a build-time toggle or runtime flag to disable WebAssembly (or specifically WASM ESM integration) is available, disabling WebAssembly execution removes the vulnerable code path at the cost of breaking any site that depends on WASM. Running Ladybird under strong OS-level sandboxing/seccomp and as an unprivileged user limits post-exploitation impact of a WebContent-process compromise but does not prevent the initial memory corruption.
Same weakness CWE-825 – Expired Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today