Wazuh Manager CVE-2025-62788

Exploitation requires the attacker to control a Wazuh agent that can send messages to the manager - explicitly a 'compromised agent' per the description - meaning prior endpoint compromise or the ability to enroll/spoof an agent with valid manager communication. The crafted message must reach the manager's message-cleaning path (OS_CleanMSG) so that w_copy_event_for_log() dereferences the freed buffer. Affected versions are all releases prior to 4.11.0 (fixed in 4.11.0). Limiting factors: the AT:P metric reflects that a specific precondition (a controlled, communicating agent) must hold; success is non-deterministic because the use-after-free only corrupts data if the freed region was reallocated and reused elsewhere, so reliable, repeatable exploitation is not guaranteed.

This is a medium-severity, defender-side memory-safety flaw whose real-world priority is moderate, not critical. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 and, importantly, declares VC:N/VI:N/VA:L - i.e. no confidentiality or integrity impact and only LOW availability impact at the vulnerable system. This directly conflicts with the prose description, which repeatedly frames the issue as a compromise of application 'integrity.' That conflict matters: the CVSS numerics say the practical outcome is a low-impact availability/data-corruption event, while the narrative implies integrity corruption - verify intended impact with the Wazuh advisory before weighting this as an integrity threat. The AT:P (Attack Requirement: Present) metric and the phrase 'compromised agent' are the real gatekeeper: although PR:N is set, exploitation presupposes the attacker already controls or has enrolled a Wazuh agent that can send authenticated messages to the manager, so this is not a drive-by unauthenticated internet attack. It is a post-foothold or malicious-agent escalation. POC/exploit material is reported as publicly available (the GitHub Security Advisory GHSA-qjcw-fjvh-8q4g is tagged as an exploit reference), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - treat public exploit availability and active exploitation as distinct. Net: patch it as routine hardening of a security-monitoring chokepoint, but it does not warrant emergency out-of-band response absent other signals.

An attacker who has compromised an endpoint running a Wazuh agent (or who can enroll/spoof an agent) crafts a malformed event message and sends it to the Wazuh manager. When the manager processes it, OS_CleanMSG() frees a buffer that w_copy_event_for_log() then re-references, triggering a use-after-free (CWE-416) that can corrupt valid in-memory data on the manager. Public exploit/advisory material (GHSA-qjcw-fjvh-8q4g) describing the condition exists, though reliable exploitation is non-deterministic because it depends on heap state at the time of the free.