CVE-2025-62788 - CVE House
Back to Database
Status published Medium CVE-2025-62788

Wazuh Vulnerable to Heap Use After Free in w_copy_event_for_log

Vulnerability Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, w_copy_event_for_log() references memory (initially allocated in OS_CleanMSG()) after it has been freed. A compromised agent can potentially compromise the integrity of the application by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can leverage this issue to potentially compromise the integrity of the application (the use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere). This vulnerability is fixed in 4.11.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62788

Credits & Attribution

No credits recorded in the NVD database.

References

More from wazuh

View All →
CVE-2025-64483
Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint
Medium 5.3
CVE-2025-64169
Wazuh NULL pointer dereference in fim_alert line 666
Medium 5.1
CVE-2025-62792
Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match
Medium 6.9
CVE-2025-62791
Wazuh vulnerable to NULL pointer dereference in DecodeCiscat
Medium 6.9
CVE-2025-62790
Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state
Medium 6.9

Affected Vendor

Affected Software

wazuh
Vulnerable Versions:
< 4.11.0

Timeline

Official Publish: October 29th, 2025
Last Modified: October 29th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-416

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact