CVE-2025-62791 - CVE House

Back to Database

Status published Medium CVE-2025-62791

Wazuh vulnerable to NULL pointer dereference in DecodeCiscat

6.9 CVSS

Vulnerability Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation does not check the return the value of cJSON_GetObjectItem() for a possible NULL value in case of an error. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62791

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-gcwf-6p6m-gvm7

More from wazuh

View All →

Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint

Wazuh NULL pointer dereference in fim_alert line 666

Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match

Wazuh vulnerable to NULL pointer dereference in fim_fetch_attributes_state

Wazuh vulnerable to NULL pointer dereference in fim_alert line 712

Affected Vendor

wazuh

View all reports →

Affected Software

wazuh

Vulnerable Versions:

< 4.11.0

Timeline

Official Publish: October 29th, 2025

Last Modified: October 29th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-252 CWE-476

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1499.004 Application or System Exploitation

T1489 Service Stop

T1203 Exploitation for Client Execution

T1190 Exploit Public-Facing Application