High severity · published Oct 29, 2025
CVE-2025-62785
Wazuh is a free and open source platform used for threat prevention, detection, and response
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. fillData() implementation does not check whether value is NULL or not before calling os_strdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.10.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wazuh · Wazuh
before 4.10.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62785
Patch
https://github.com/wazuh/wazuh/commit/17f8dc23a6211cbb398a262fcd1b0fe61b0a8eb6
Exploit
https://github.com/wazuh/wazuh/security/advisories/GHSA-mqpq-pcxc-8259
More from Wazuh
9.9
CVE-2025-24016
Remote code execution in Wazuh server
9.9
CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
9.8
CVE-2024-32038
Wazuh is a free and open source platform used for threat prevention, detection, and response
9.8
CVE-2021-44079
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution
9.3
CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request