What is CVE-2025-43853?

CVE-2025-43853 is a medium-severity vulnerability in Bytecodealliance Wasm-micro-runtime, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 5.5/10. Published 2025-05-15.

How severe is CVE-2025-43853?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2025-43853 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Bytecodealliance Wasm-micro-runtime

CVE-2025-43853

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WA…

EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Bytecodealliance Wasm-micro-runtime — versions < 2.3.0
Bytecodealliance Webassembly_micro_runtime

Weakness classification (CWE)

CWE-61 — UNIX Symbolic Link (Symlink) Following

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-43853?: CVE-2025-43853 is a medium-severity vulnerability in Bytecodealliance Wasm-micro-runtime, classified under UNIX Symbolic Link (Symlink) Following. CVSS score: 5.5/10. Published 2025-05-15.
How severe is CVE-2025-43853?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2025-43853 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.