7.0
High
CVE-2025-43853 The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports…
Description
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wasm-micro-runtime 2.3 | earliest → < 2.3.0 | 2.3.0 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of wasm-micro-runtime
The 8 CVEs of wasm-micro-runtime →
CVE-2026-54912
WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch
8.8
High
CVE-2026-54913
WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest
6.9
Medium
CVE-2026-54914
WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer
8.3
High
CVE-2025-64713
WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime
5.1
Medium