Symlink Following Vulnerability in WebAssembly Micro Runtime on Windows
CVE-2025-43853

7HIGH

Key Information:

Vendor

Bytecodealliance

Status
Wasm-micro-runtime
Vendor
CVE Published:
15 May 2025

What is CVE-2025-43853?

The WebAssembly Micro Runtime (WAMR) contains a vulnerability where users running versions up to 2.2.0 on Windows can create symlinks that point outside of designated directories. This flaw allows these symlinks to access host files, potentially leading to unauthorized data exposure. The issue is mitigated in version 2.3.0, which addresses the vulnerability by restricting symlink functionality within the predefined sandbox environment.

Affected Version(s)

wasm-micro-runtime < 2.3.0

References

https://github.com/bytecodealliance/wasm-micro-runtime/se...
x_refsource_CONFIRM
https://github.com/bytecodealliance/wasm-micro-runtime/co...
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.