High · published October 29, 2025
⚠️ A crafty agent message can reveal sensitive data! Before version 4.12.0, Wazuh’s buffer over-read issue lets attackers peek beyond the curtain and access private information. 🔍 Think of it like a restaurant where the chef accidentally leaves a back door open — a curious diner could overhear secret recipes by eavesdropping! In this case, it’s the unguarded buffer that spills the beans. An attacker who can craft and send a message could trigger a buffer over-read, potentially exposing sensitive information stored within the Wazuh manager. While not a guaranteed breach, this could lead to a hefty risk if attackers gain access to critical data.
Think of it like a restaurant where the chef accidentally leaves a back door open — a curious diner could overhear secret recipes by eavesdropping! In this case, it’s the unguarded buffer that spills the beans. This vulnerability arises from a buffer over-read in the `w_expression_match()` function when `strlen()` is called on `str_test` without proper NULL termination during allocation in `OS_CleanMSG()`. As a result, malicious agents may exploit this flaw to read beyond allocated memory boundaries.
An attacker who can craft and send a message could trigger a buffer over-read, potentially exposing sensitive information stored within the Wazuh manager. While not a guaranteed breach, this could lead to a hefty risk if attackers gain access to critical data. Update to Wazuh version 4.12.0 or later to patch this vulnerability. Additionally, review the configurations and ensure all agent messages are sent securely to mitigate potential risks. Regularly audit your Wazuh setup for any misconfigurations or vulnerabilities. You've got this! Fixing this vulnerability is straightforward, and soon you'll have your Wazuh instance back to top-notch security! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wazuh/wazuh | < 4.12.0 | 4.12.0 |