CVE-2025-62785: Wazuh fillData NULL pointer dereference causes analysisd crash
Wazuh is a free and open source platform used for threat prevention, detection, and response. fillData() implementation does not check whether value is NULL or not before calling osstrdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.10.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.10.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62785?
CVE-2025-62785 is classified as a medium severity vulnerability due to potential crashes of the analysisd service.
How do I fix CVE-2025-62785?
To fix CVE-2025-62785, upgrade Wazuh to version 4.10.3 or later where the vulnerability has been patched.
What versions of Wazuh are affected by CVE-2025-62785?
CVE-2025-62785 affects Wazuh versions up to and including 4.10.2.
What is the impact of CVE-2025-62785 on my Wazuh deployment?
The impact of CVE-2025-62785 includes potential service crashes caused by specially crafted messages from a compromised agent.
Is CVE-2025-62785 exploited in the wild?
As of now, there is no public indication that CVE-2025-62785 is actively being exploited in the wild.