PT-2025-44326 · Wazuh · Wazuh

Published 2025-01-23 · Updated 2025-10-29 · CVE-2025-62792

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.12.0

Description Wazuh, a free and open source platform for threat prevention, detection, and response, contains a flaw where a buffer over-read can occur in the w expression match() function. This happens when strlen() is called on str test because the corresponding buffer is not properly NULL terminated during allocation in OS CleanMSG(). A compromised agent can trigger a read operation beyond the allocated buffer's boundaries, potentially exposing sensitive information, by sending a specially crafted message to the Wazuh manager. An attacker who can craft and send an agent message to the Wazuh manager can exploit this issue.

Recommendations Update to Wazuh version 4.12.0 or later.

Exploit

Fix

Buffer Over-read

Weakness Enumeration

CWE-126

CWE-170

Related Identifiers

BDU:2025-14490

CVE-2025-62792

GHSA-2672-VFHM-XHR6

Affected Products

Wazuh

References · 9

• 🔥 https://github.com/wazuh/wazuh/security/advisories/GHSA-2672-vfhm-xhr6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62792.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62792 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14490 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62792 · Security Note
• https://twitter.com/VulmonFeeds/status/1983671259259879703 · Twitter Post
• https://twitter.com/CVEnew/status/1983585066077835418 · Twitter Post
• https://t.me/CVEtracker/36091 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44326 · Note