Vulnerability in Bytecodealliance Wasm-micro-runtime
CVE-2025-54126
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. In versions 2.4.0 and below, iwasm uses --addr-pool with an…
EPSS: 0.006 (44.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2025-54126?
- CVE-2025-54126 is a medium-severity vulnerability in Bytecodealliance Wasm-micro-runtime, classified under Exposure of Resource to Wrong Sphere. CVSS score: 5.3/10. Published 2025-07-29.
- How severe is CVE-2025-54126?
- Medium severity. CVSS v3 base score is 5.3 out of 10.