Wazuh up to 4.10.1 DecodeWinevt buffer over-read

Summaryinfo

A vulnerability was found in Wazuh up to 4.10.1 and classified as problematic. This vulnerability affects the function DecodeWinevt. The manipulation results in buffer over-read. This vulnerability is reported as CVE-2025-62787. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Wazuh up to 4.10.1. It has been classified as problematic. Affected is the function DecodeWinevt. The manipulation with an unknown input leads to a buffer over-read vulnerability. CWE is classifying the issue as CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeWinevt() when child_attr[p]->attributes[j] is accessed, because the corresponding index (j) is incorrect. A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. While the buffer over-read is always triggered while resolving the arguments of mdebug2, specific configuration options (analysisd.debug=2) need to be in place for the respective data to be leaked. This vulnerability is fixed in 4.10.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-62787 since 10/22/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.10.2 eliminates this vulnerability. Applying the patch 267d5d55de490469a9ec24a2b936bb3c5aa8fdda is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Wazuh

Version

• 4.10.0
• 4.10.1

License

• open-source

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion