CVE-2025-62791: 
Wazuh Agent vulnerability analysis and mitigation

Wazuh, a free and open source platform used for threat prevention, detection, and response, was found to contain a vulnerability in versions prior to 4.11.0. The vulnerability (CVE-2025-62791) was discovered in the DecodeCiscat() implementation, which fails to check the return value of cJSON_GetObjectItem() for possible NULL values. This security flaw was disclosed on October 29, 2025 (GitHub Advisory).

The vulnerability exists in the DecodeCiscat() function at line 76 of the wazuh/src/analysisd/decoders/ciscat.c file. When processing certain input messages, cJSON_GetObjectItem(logJSON, "type") returns NULL, and attempting to access the valuestring property of NULL results in a NULL pointer dereference error. The vulnerability has received a CVSS v4.0 base score of 6.9 (Medium) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, and a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

When successfully exploited, this vulnerability can cause the Wazuh analysisd process to crash, resulting in a denial of service condition for the Wazuh manager. The impact is primarily focused on system availability, with no direct effect on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability has been fixed in Wazuh version 4.11.0. Users are advised to upgrade to this version or later to mitigate the security risk (GitHub Advisory).