CVE-2025-43853 - CVE House
Back to Database
Status published High CVE-2025-43853

iwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi feature

Vulnerability Description

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-43853

Credits & Attribution

No credits recorded in the NVD database.

References

More from bytecodealliance

View All →
CVE-2025-64713
WebAssembly Micro Runtime frame_offset_bottom array bounds overflow in fast Interpreter mode when handling GET_GLOBAL(I32) followed by if opcode
Medium 5.1
CVE-2025-64704
WebAssembly Micro Runtime vulnerable to a segmentation fault in v128.store instruction
Medium 4.7
CVE-2025-64345
Wasmtime provides unsound API access to a WebAssembly shared linear memory
Low 1.8
CVE-2025-62711
Wasmtime vulnerable to segfault when using component resources
Low 2.1
CVE-2025-61670
Wasmtime has memory leak in C API with `externref` and `anyref` types
Low 1

Affected Vendor

bytecodealliance

View all reports →

Affected Software

wasm-micro-runtime
Vulnerable Versions:
< 2.3.0

Timeline

Official Publish: May 15th, 2025
Last Modified: May 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-61

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.