CVE-2026-58592 Details

A memory-safety vulnerability has been identified in Ladybird's WebAssembly ECMAScript Module (ESM) integration. This flaw arises from a dangling reference created when a JavaScript function is imported into a WebAssembly module via the ESM path. The WebAssembly module loader passes a stack-local Wasm::FunctionType by reference to a host function callback, which captures and later accesses that reference. Once the ESM linking process concludes, the FunctionType is destroyed, leaving the callback with a dangling reference. This issue is not present in the standard instantiation path, which uses a long-lived reference. Exploitation of this vulnerability is made possible by stale result-type data, which allows the host callback to return an empty result vector for a statically non-empty result. Consequently, the destination register retains an attacker-influenced value, which is then processed by the WebAssembly garbage-collected array set handler. This handler bit-casts the reference's low bits to an ArrayInstance pointer, after only a null check, resulting in an arbitrary write. The vulnerability can be exploited through a web page, leading to code execution in the WebContent process.

The host function callback should be modified to own the Wasm::FunctionType it utilizes, either by capturing a stable copy or managing the reference in a way that prevents it from becoming dangling. Additionally, the WebAssembly interpreter should validate the arity of host function results against the expected static types before resuming bytecode execution.