How severe is CVE-2025-54126?

CVE-2025-54126 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-54126 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-54126?

CVE-2025-54126 affects Bytecodealliance Webassembly Micro Runtime. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-54126?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-54126 have an EU (EUVD) identifier?

Yes. CVE-2025-54126 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23050.

When was CVE-2025-54126 published?

CVE-2025-54126 was published on 2025-07-29 and last updated on 2026-06-17.

CVE-2025-54126

CVE-2025-54126 is a medium-severity vulnerability in Bytecodealliance Webassembly Micro Runtime with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-668.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.9
EPSS exploit prediction: 1% (45th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-23050
Weakness: CWE-668
Affected product: Bytecodealliance Webassembly Micro Runtime
Published: 2025-07-29
Last modified: 2026-06-17

Description

The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. In versions 2.4.0 and below, iwasm uses --addr-pool with an IPv4 address that lacks a subnet mask, allowing the system to accept all IP addresses. This can unintentionally expose the service to all incoming connections and bypass intended access restrictions. Services relying on --addr-pool for restricting access by IP may unintentionally become open to all external connections. This may lead to unauthorized access in production deployments, especially when users assume that specifying an IP without a subnet mask implies a default secure configuration. This is fixed in version 2.4.1.

Frequently asked questions

What is CVE-2025-54126?: The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. In versions 2.4.0 and below, iwasm uses --addr-pool with an IPv4 address that lacks a subnet mask, allowing the system to accept all IP addresses. This can unintentionally expose the service to all incoming connections and bypass intended access restrictions. Services relying on --addr-pool for restricting access by IP may unintentionally become open to all external connections. This may lead to unauthorized access in production deployments, especially when users assume that specifying an IP without a subnet mask implies a default secure configuration. This is fixed in version 2.4.1.
How severe is CVE-2025-54126?: CVE-2025-54126 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2025-54126 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-54126?: CVE-2025-54126 affects Bytecodealliance Webassembly Micro Runtime. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-54126?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-54126 have an EU (EUVD) identifier?: Yes. CVE-2025-54126 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23050.
When was CVE-2025-54126 published?: CVE-2025-54126 was published on 2025-07-29 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:bytecodealliance:webassembly_micro_runtime:*:*:*:*:*:*:*:*

More vulnerabilities in Bytecodealliance Webassembly Micro Runtime

CVE-2024-25431 — High (CVSS 7.8): An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker…
CVE-2024-27532 — High (CVSS 7.5): wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in…
CVE-2024-34251 — High (CVSS 7.5): An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a…
CVE-2023-48105 — High (CVSS 7.5): An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker…
CVE-2024-34250 — Medium (CVSS 6.2): A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a…
CVE-2025-43853 — Medium (CVSS 5.5): The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports…

All CVEs affecting Bytecodealliance Webassembly Micro Runtime →

Other CWE-668 (Exposure of Resource to Wrong Sphere) vulnerabilities

CVE-2025-2857 — Critical (CVSS 10.0): Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in…
CVE-2019-8779 — Critical (CVSS 10.0): A logic issue applied the incorrect restrictions. This issue was addressed by updating the logic to apply the correct…
CVE-2012-1846 — Critical (CVSS 10.0): Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging…
CVE-2022-43684 — Critical (CVSS 9.9): ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow…
CVE-2022-24900 — Critical (CVSS 9.9): Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer.…
CVE-2019-16541 — Critical (CVSS 9.9): Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site…

Browse all CWE-668 (Exposure of Resource to Wrong Sphere) vulnerabilities →