Buffer Over-Read Vulnerability in Wazuh Platform by Wazuh

CVE-2025-62787

What is CVE-2025-62787?

Wazuh, an open-source platform for threat prevention, detection, and response, exhibits a buffer over-read vulnerability prior to version 4.10.2. The issue arises within the DecodeWinevt() function, specifically during the access of child_attr[p]->attributes[j], where the index (j) can become incorrect. This vulnerability allows a malicious actor to exploit the buffer over-read when sending specially crafted messages to the Wazuh manager. If certain configuration options (analysisd.debug=2) are applied, the integrity of sensitive information may be compromised through unauthorized READ operations that extend beyond the designated buffer limits. The issue has been remediated in version 4.10.2.

References