CVE-2025-62787: Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-10-29 · updated 2026-10-19
Weakness: CWE-126

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) is incorrect. A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. While the buffer over-read is always triggered while resolving the arguments of mdebug2, specific configuration options (analysisd.debug=2) need to be in place for the respective data to be leaked. This vulnerability is fixed in 4.10.2.

Affected products

wazuh: before 4.10.2 — fixed in 4.10.2

How to fix

Upgrade to a fixed version: wazuh 4.10.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-62787 or the next vulnerability affects your stack