bytecodealliance wasm-micro-runtime up to 2.2.x on Windows symlink

Summaryinfo

A vulnerability labeled as critical has been found in bytecodealliance wasm-micro-runtime up to 2.2.x on Windows. Impacted is an unknown function. Such manipulation leads to symlink. This vulnerability is documented as CVE-2025-43853. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in bytecodealliance wasm-micro-runtime up to 2.2.x on Windows. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-43853 since 04/17/2025. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.3.0 eliminates this vulnerability. Applying the patch 28702edaf739cdeee54e81efe5868bf00724c33c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• bytecodealliance

Name

• wasm-micro-runtime

Version

• 2.0
• 2.1
• 2.2

License

• open-source

Website

• Product: https://github.com/bytecodealliance/wasm-micro-runtime/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion