One unchecked calloc lets a wasm2c guest run shell on your host
WABT's wasm2c, which compiles untrusted WebAssembly into C you link into your own binary, never checks the return of a single calloc in its table allocator. A guest can make that allocation fail, turning every table index into an absolute host address and writing files or running shell on the machine. Firefox and a long tail of no-JIT sandbox software ship this toolchain, and the bug goes back to 2018. The memory allocator nearby got a guard last year; the table allocator never did.