Cyber Resilience

CVE-2025-62792

Memory Safety in Wazuh ≤ 4.12.0

Public PoCMemory Safety
Published
29 October 2025
Modified
03 November 2025
Patch / advisory
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0036 29th percentile
Risk Priority 41 floored blend · peak EPSS

Summary

CVE-2025-62792 is a medium-severity Buffer Over-read (CWE-126) vulnerability in Wazuh Wazuh. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL terminated…

more

during its allocation in OS_CleanMSG(). A compromised agent can cause a READ operation beyond the end of the allocated buffer (which may contain sensitive information) by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause a buffer over-read and potentially access sensitive data. This vulnerability is fixed in 4.12.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-62787Same product: Wazuh Wazuh
CVE-2025-62786Same product: Wazuh Wazuh
CVE-2026-41499Same product: Wazuh Wazuh
CVE-2025-59938Same product: Wazuh Wazuh
CVE-2026-44251Same product: Wazuh Wazuh
CVE-2025-62788Same product: Wazuh Wazuh
CVE-2026-25772Same product: Wazuh Wazuh
CVE-2026-34150Same product: Wazuh Wazuh
CVE-2026-26204Same product: Wazuh Wazuh
CVE-2023-42463Same product: Wazuh Wazuh

Affected Assets

wazuh
wazuh
≤ 4.12.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation (static analysis, fuzzing, bounds checking tests) directly finds buffer over-read flaws.

Requiring documented development standards and tools can enforce safe string-handling practices that produce correct null termination.

Engineering principles such as memory-safe design and bounds-checked abstractions structurally stop introduction of out-of-bounds reads.

Process isolation limits the blast radius of an over-read to the compromised domain.

Input validation enforces length and index constraints that prevent many externally triggered over-reads.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure development practices directly prevent introduction of buffer over-read weaknesses.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover buffer over-read flaws via scanning or review.

PR.PS-02 partial match
prevents

Patching or replacing vulnerable software removes known instances of buffer over-read bugs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect buffer over-reads before release.

prevents

Secure SDLC mandates input validation and bounds checking that can prevent buffer over-reads.

prevents

Application security requirements can specify buffer-size and bounds-checking rules.

prevents

Secure architecture principles include memory-safety and bounds-checking design choices.

prevents

Secure coding standards directly require bounds-checked buffer access, mitigating over-reads.

References