High · published October 29, 2025
⚠️ A crafty message is all it takes! Before version 4.11.0, Wazuh's memory management has a rather sneaky flaw that could let compromised agents send destructive messages to the manager. 🔥 Think of it like a restaurant where a bad chef can mess up the order of ingredients — once the soup pot has been dumped, any leftovers could spoil the entire meal. An attacker sending a poorly crafted message could corrupt vital data, just like an old ingredient spoiling your dish! If exploited, this vulnerability could compromise the integrity of the Wazuh application, potentially leading to corrupted data and a breakdown of threat detection. While it’s not currently being actively exploited, the risk of having a compromised system is still a serious concern!
Think of it like a restaurant where a bad chef can mess up the order of ingredients — once the soup pot has been dumped, any leftovers could spoil the entire meal. An attacker sending a poorly crafted message could corrupt vital data, just like an old ingredient spoiling your dish! CVE-2025-62788 occurs because the function w_copy_event_for_log() accesses memory that has already been freed, which can corrupt valid data if that memory is reallocated for another purpose. An attacker with the ability to send a crafted agent message can potentially leverage this flaw against the Wazuh manager.
If exploited, this vulnerability could compromise the integrity of the Wazuh application, potentially leading to corrupted data and a breakdown of threat detection. While it’s not currently being actively exploited, the risk of having a compromised system is still a serious concern! Update to Wazuh version 4.11.0 immediately to patch this vulnerability. It's also a good idea to review logs for any suspicious messages that may have been sent to the manager. Always keep your systems up to date for the best protection! You've got this! Follow these steps, and you'll have your Wazuh system secure in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wazuh/wazuh | < 4.11.0 | 4.11.0 |