PT-2025-44326 · Wazuh · Wazuh

Published 2025-01-23 · Updated 2025-10-29 · CVE-2025-62792

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.12.0

Description Wazuh, a free and open source platform for threat prevention, detection, and response, contains a flaw where a buffer over-read can occur in the

w expression match()

function. This happens when

strlen()

is called on

str test

because the corresponding buffer is not properly NULL terminated during allocation in

OS CleanMSG()

. A compromised agent can trigger a read operation beyond the allocated buffer's boundaries, potentially exposing sensitive information, by sending a specially crafted message to the Wazuh manager. An attacker who can craft and send an agent message to the Wazuh manager can exploit this issue.

Recommendations Update to Wazuh version 4.12.0 or later.

Exploit

Fix

Buffer Over-read

Weakness Enumeration

CWE-170

CWE-126

Related Identifiers

BDU:2025-14490

CVE-2025-62792

GHSA-2672-VFHM-XHR6

Affected Products

Wazuh

References · 9

• 🔥 https://github.com/wazuh/wazuh/security/advisories/GHSA-2672-vfhm-xhr6 · Exploit
• https://bdu.fstec.ru/vul/2025-14490 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62792 · Security Note
• https://twitter.com/VulmonFeeds/status/1983671259259879703 · Twitter Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44326 · Note
• https://twitter.com/CVEnew/status/1983585066077835418 · Twitter Post
• https://t.me/CVEtracker/36091 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62792 · Note