PT-2025-44314 · Wazuh · Wazuh

Published 2025-01-23 · Updated 2025-11-01 · CVE-2025-62786

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.10.2

Description Wazuh, a free and open source platform for threat prevention, detection, and response, contains a heap-based out-of-bounds write issue in the

decode win permissions

function. This flaw allows a compromised agent to potentially execute remote code on the Wazuh manager by sending a specially crafted message. The exploitability of this issue depends on the specifics of the heap allocator. An attacker who can craft and send an agent message to the Wazuh manager may be able to achieve remote code execution. The issue involves writing a NULL byte 2 bytes before the start of the buffer allocated to

decoded it

.

Recommendations Update to Wazuh version 4.10.2 or later.

Fix

RCE

Weakness Enumeration

CWE-124

Related Identifiers

BDU:2025-14484

CVE-2025-62786

GHSA-2C8R-P6R5-XXMR

Affected Products

Wazuh

References · 11

• https://github.com/wazuh/wazuh/commit/2257d7998aaff34263169d16f4afc491564a771c · Patch
• https://github.com/wazuh/wazuh/security/advisories/GHSA-2c8r-p6r5-xxmr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62786 · Security Note
• https://bdu.fstec.ru/vul/2025-14484 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62786 · Vendor Advisory
• https://t.me/CVEtracker/36077 · Telegram Post
• https://twitter.com/SecAideInfo/status/1984564474158653877 · Twitter Post
• https://twitter.com/CVEnew/status/1983569672969539877 · Twitter Post
• https://t.me/cveNotify/140859 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44314 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62786 · Note