CVE-2025-62792

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL terminated during its allocation in OS_CleanMSG(). A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. This vulnerability is fixed in 4.12.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wazuh/wazuh/security/advisories/GHSA-2672-vfhm-xhr6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Previo a la 4.12.0, se produce una lectura excesiva del búfer en w_expression_match() cuando se llama a strlen() en str_test, debido a que el búfer correspondiente no se termina correctamente con NULL durante su asignación en OS_CleanMSG(). Un agente comprometido puede causar una operación de LECTURA más allá del final del búfer asignado (que puede contener información sensible) enviando un mensaje especialmente diseñado al gestor de Wazuh. Un atacante que sea capaz de diseñar y enviar un mensaje de agente al gestor de Wazuh puede causar una lectura excesiva del búfer y potencialmente acceder a datos sensibles. Esta vulnerabilidad se corrige en la 4.12.0.

Information

Published : 2025-10-29 17:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-62792

Mitre link : CVE-2025-62792

CVE.ORG link : CVE-2025-62792

JSON object : View

Products Affected

wazuh

wazuh

CWE

CWE-126

Buffer Over-read

CWE-170

Improper Null Termination

{"id": "CVE-2025-62792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62792", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T18:10:06.172333Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": "< 4.12.0"}]}]}], "published": "2025-10-29T17:15:37.280", "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-2672-vfhm-xhr6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-126"}, {"lang": "en", "value": "CWE-170"}]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL terminated during its allocation in OS_CleanMSG(). A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. This vulnerability is fixed in 4.12.0."}, {"lang": "es", "value": "Wazuh es una plataforma de c\u00f3digo abierto y gratuita utilizada para la prevenci\u00f3n, detecci\u00f3n y respuesta a amenazas. Previo a la 4.12.0, se produce una lectura excesiva del b\u00fafer en w_expression_match() cuando se llama a strlen() en str_test, debido a que el b\u00fafer correspondiente no se termina correctamente con NULL durante su asignaci\u00f3n en OS_CleanMSG(). Un agente comprometido puede causar una operaci\u00f3n de LECTURA m\u00e1s all\u00e1 del final del b\u00fafer asignado (que puede contener informaci\u00f3n sensible) enviando un mensaje especialmente dise\u00f1ado al gestor de Wazuh. Un atacante que sea capaz de dise\u00f1ar y enviar un mensaje de agente al gestor de Wazuh puede causar una lectura excesiva del b\u00fafer y potencialmente acceder a datos sensibles. Esta vulnerabilidad se corrige en la 4.12.0."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA335ECF-47B9-4FD9-988F-566DE523AB43", "versionEndExcluding": "4.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}