PT-2025-44313 · Wazuh · Wazuh

Published 2025-01-23 · Updated 2025-10-29 · CVE-2025-62785

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.10.2

Description Wazuh, a platform for threat prevention, detection, and response, contains a flaw in the fillData() implementation. This implementation does not verify if a value is NULL before utilizing os strdup() on it. A malicious actor capable of crafting and sending a specific message to the Wazuh manager can induce a crash of the analysisd component, rendering it unavailable. This could potentially disrupt threat detection and response capabilities.

Recommendations Update to version 4.10.2 or later.

Fix

NULL Pointer Dereference

Unchecked Return Value

Weakness Enumeration

CWE-476

CWE-252

Related Identifiers

BDU:2025-14483

CVE-2025-62785

GHSA-MQPQ-PCXC-8259

Affected Products

Wazuh

References · 10

• https://github.com/wazuh/wazuh/commit/17f8dc23a6211cbb398a262fcd1b0fe61b0a8eb6 · Patch
• https://github.com/wazuh/wazuh/security/advisories/GHSA-mqpq-pcxc-8259 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14483 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62785 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62785 · Vendor Advisory
• https://twitter.com/CVEnew/status/1983563340950425864 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44313 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62785 · Note
• https://t.me/CVEtracker/36076 · Telegram Post
• https://t.me/cveNotify/140858 · Telegram Post