CVE-2025-62787
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-11-03

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) is incorrect. A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. While the buffer over-read is always triggered while resolving the arguments of mdebug2, specific configuration options (analysisd.debug=2) need to be in place for the respective data to be leaked. This vulnerability is fixed in 4.10.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-29
Last Modified
2025-11-03
Generated
2026-05-07
AI Q&A
2025-10-29
EPSS Evaluated
2026-05-05
NVD
CVE-2025-62787
EUVD
EUVD-2025-36682
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wazuh wazuh to 4.10.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a buffer over-read in Wazuh versions prior to 4.10.2. It occurs in the DecodeWinevt() function when an incorrect index is used to access child attributes, causing a read operation beyond the allocated buffer. A compromised agent can send a specially crafted message to the Wazuh manager to trigger this, potentially allowing access to sensitive information contained in memory. The vulnerability is specifically triggered when certain debug configuration options are enabled.


How can this vulnerability impact me? :

If exploited, this vulnerability can allow an attacker who controls a Wazuh agent to cause the Wazuh manager to read beyond its allocated memory buffer, potentially exposing sensitive information. This could lead to unauthorized disclosure of data and compromise the security of the system monitoring environment.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is fixed in Wazuh version 4.10.2. Immediate mitigation steps include upgrading the Wazuh manager to version 4.10.2 or later. Additionally, reviewing and disabling the specific configuration option 'analysisd.debug=2' can help prevent sensitive data leakage until the upgrade is applied.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart