CVE-2025-62791: Wazuh vulnerable to NULL pointer dereference in DecodeCiscat
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation does not check the return the value of cJSONGetObjectItem() for a possible NULL value in case of an error. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62791?
CVE-2025-62791 has been assessed as a medium severity vulnerability.
How do I fix CVE-2025-62791?
To fix CVE-2025-62791, upgrade Wazuh to version 4.11.0 or higher.
What types of attacks can exploit CVE-2025-62791?
CVE-2025-62791 can be exploited by a compromised agent to cause denial of service.
What is affected by CVE-2025-62791?
CVE-2025-62791 affects Wazuh versions prior to 4.11.0.
Is there a workaround for CVE-2025-62791 until I can upgrade?
There are no official workarounds for CVE-2025-62791; upgrading is the recommended action.