Wazuh CVE-2025-62787

Two concrete prerequisites must both hold for data to leak: (1) the attacker must control an agent that can send messages to the manager - i.e. an already-compromised or maliciously enrolled Wazuh agent (reflected as PR:H), and (2) the Wazuh manager must be running with the non-default debug setting analysisd.debug=2, because the over-read data is only exposed while resolving the arguments of the mdebug2() debug log call. The over-read itself always triggers in DecodeWinevt() when the crafted winevt message is parsed, but without analysisd.debug=2 the leaked bytes are never emitted. Limiting factors: requires privileged/trusted agent position, requires a non-default verbose debug configuration, and affects only the Windows Event Channel decoder path; default production deployments do not expose the leaked data.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-assigned CVSS 4.0 score is only 2.1, driven by PR:H (attacker must already control an enrolled/compromised Wazuh agent), AT:P (a specific attack requirement - the analysisd.debug=2 configuration must be set for data to actually leak), and limited impact (VC:L/VI:N/VA:L): a bounded over-read of confidentiality with no integrity impact and only marginal availability effect. POC/exploit material exists (the GitHub Security Advisory GHSA-3hhq-5367-98q6 and the fixing commit), so publicly available exploit code exists, but there is NO CISA KEV listing and no EPSS value was supplied in the input, so exploitation probability cannot be quantified from this data. Crucially, the real-world confidentiality impact is gated behind a non-default debug setting - on default deployments the over-read is triggered but the leaked data is never emitted. The combination of required privileged access (a compromised agent), a required non-default configuration, and low technical impact means this is a high-confidence LOW, not a high-CVSS/low-real-risk mismatch. No key signals conflict; the main gap is the absence of EPSS/KEV data to judge exploitation activity.

An attacker who has already compromised a Wazuh agent (or can enroll a malicious one) crafts a specially formed Windows Event Channel message and sends it to the Wazuh manager, triggering a buffer over-read in DecodeWinevt() due to an incorrect array index. If the manager is running with analysisd.debug=2, the over-read memory - which may contain adjacent sensitive data - is written into debug log output via the mdebug2 call. Public exploit/advisory material exists (GHSA-3hhq-5367-98q6 and the fixing commit).