CVE-2025-43853: bytecodealliance webassembly micro runtime

csirt@kutim:~/threat-intel/cve/CVE-2025-43853

CVSS 5.5 · Medium EPSS 0,29%

Kerentanan UNIX Symbolic Link (Symlink) Following pada bytecodealliance webassembly micro runtime. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.

Rincian

Terbit di NVD: 15 Mei 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-61: UNIX Symbolic Link (Symlink) Following
EPSS (30 hari): 0,29% peluang dieksploitasi; lebih tinggi dari 20,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
bytecodealliance	webassembly micro runtime	Semua versi sebelum 2.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/bytecodealliance/wasm-micro-runtime/commit/28702edaf739cdeee54e81efe5868bf00724c33c patch
https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-8fc8-4g25-c8m7 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.