CVE-2026-58592

{
  "id": "CVE-2026-58592",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-01T20:17:11.600",
  "lastModified": "2026-10-25T16:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to create_host_function, whose host callback captures and later reads that reference; once the ESM link-loop iteration ends the FunctionType is destroyed, leaving the callback with a dangling reference (the normal instantiate path uses a long-lived reference and is not affected). Stale result-type data lets the host callback return an empty result vector for a statically non-empty result, so the destination register retains an attacker-influenced value that is then consumed by the WASM-GC array.set handler, which bit-casts the reference low bits to an ArrayInstance pointer after only a null check, yielding an arbitrary write. A web page can chain this into code execution in the WebContent process. Verified reachable from HTML content without any instrumentation or source modification."
    },
    {
      "lang": "es",
      "value": "Ladybird contiene una falla de seguridad de memoria por referencia colgante en su cargador de módulos de integración ESM de WebAssembly. Cuando una función de JavaScript se importa a un módulo de WebAssembly a través de la ruta ESM, WebAssemblyModule.cpp pasa un Wasm::FunctionType local de pila por referencia a create_host_function, cuyo callback de host captura y luego lee esa referencia; una vez que termina la iteración del bucle de enlace ESM, el FunctionType es destruido, dejando el callback con una referencia colgante (la ruta de instanciación normal usa una referencia de larga duración y no se ve afectada). Datos de tipo de resultado obsoletos permiten que el callback de host devuelva un vector de resultado vacío para un resultado estáticamente no vacío, por lo que el registro de destino retiene un valor influenciado por el atacante que luego es consumido por el gestor array.set de WASM-GC, que realiza un bit-cast de los bits bajos de la referencia a un puntero ArrayInstance después de solo una verificación de nulo, lo que produce una escritura arbitraria. Una página web puede encadenar esto en la ejecución de código en el proceso WebContent. Verificado como alcanzable desde contenido HTML sin ninguna instrumentación o modificación del código fuente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "LadybirdBrowser",
          "product": "Ladybird",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2f9dc7e9f35eed67dde3f9e8567d390dc4f0c665",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-02T15:27:43.547840Z",
          "id": "CVE-2026-58592",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        },
        {
          "lang": "en",
          "value": "CWE-825"
        },
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/LadybirdBrowser/ladybird/commit/2f9dc7e9f35eed67dde3f9e8567d390dc4f0c665",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/LadybirdBrowser/ladybird/issues/11569",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/LadybirdBrowser/ladybird/pull/11606",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/bikini/exploitarium/tree/main/ladybird-wasm-esm-host-function-rce-poc",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/ladybird-web-reachable-code-execution-via-dangling-functiontype-reference-in-webassembly-esm-integration",
      "source": "[email protected]"
    }
  ]
}