Microsoft advisory for CVE-2025-43853
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-43853. This page also shows what EchelonGraph holds for CVE-2025-43853, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products3
- azl3 fluent-bit 3.1.9-4 on Azure Linux 3.0
- cbl2 fluent-bit 3.0.6-2
- cbl2 fluent-bit 3.0.6-2 on CBL-Mariner 2.0
🧭 EchelonGraph on CVE-2025-43853
- EchelonGraph score
- 5.5 MEDIUM
- CISA KEV
- Not listed
- Fix status
- The CVE record names the fixed release — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WAMR built with libc-uvwasi on Windows is affected by a symlink following vulnerability. On WAMR running in Windows, creating a symlink pointing outside of the preopened directory and subsequently opening it with create flag will create a file on host outside of the sandbox. If the symlink points to an existing host file, it's also possible to open it and read its content. Version 2.3.0 fixes the issue.
Published by GitHub, Inc., the CVE Numbering Authority that assigned CVE-2025-43853, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).