What is the CVSS score of CVE-2025-59938?

CVE-2025-59938 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows are affected by CVE-2025-59938?

Organizations using versions starting from 3.8.0 to should be aware of notable risk from CVE-2025-59938, a heap-based buffer overflow vulnerability rated CVSS 6.5.

Is there a public PoC exploit available for CVE-2025-59938?

Yes, a public proof-of-concept exploit is available for CVE-2025-59938. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-59938?

Within 7 days: Identify affected systems running versions starting from 3.8.0 to and apply vendor patches promptly. Monitor vendor channels for patch availability.

Windows CVE-2025-59938

MEDIUM

Heap-based Buffer Overflow (CWE-122)

2025-09-27 security-advisories@github.com

Windows Buffer Overflow Heap Overflow Microsoft Wazuh

6.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

PoC Detected

Oct 16, 2025 - 17:33 vuln.today

Public exploit code

CVE Published

Sep 27, 2025 - 01:15 nvd

MEDIUM 6.5

DescriptionNVD

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions starting from 3.8.0 to before 4.11.0, wazuh-analysisd is vulnerable to a heap buffer overflow when parsing XML elements from Windows EventChannel messages. This issue has been patched in version 4.11.0.

AnalysisAI

Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-122. Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions starting from 3.8.0 to before 4.11.0, wazuh-analysisd is vulnerable to a heap buffer overflow when parsing XML elements from Windows EventChannel messages. This issue has been patched in version 4.11.0. Affected products include: Wazuh. Version information: before 4.11.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More from same product – last 7 days

CVE-2026-40412 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil

CVE-2026-41104 CRITICAL Monitor

10.0 May 22

Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal

CVE-2026-23652 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-

CVE-2026-47280 CRITICAL Monitor

10.0 May 22

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti

CVE-2026-42901 CRITICAL Monitor

10.0 May 22

Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain

CVE-2025-59938 vulnerability details – vuln.today

Back

Windows CVE-2025-59938

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code