CVE-2025-59938: Wazuh Heap Buffer Overflow Vulnerability

CVE-2025-59938 Overview

Wazuh is an open source security platform used for threat prevention, detection, and response. CVE-2025-59938 affects the wazuh-analysisd daemon, which is vulnerable to a heap buffer overflow when parsing XML elements from Windows EventChannel messages. The flaw impacts Wazuh versions starting from 3.8.0 up to but not including 4.11.0. An authenticated attacker with low privileges can trigger the overflow over the network, causing the analysis daemon to crash. The issue has been patched in Wazuh 4.11.0.

Critical Impact
A low-privileged attacker can send crafted Windows EventChannel messages to trigger a heap buffer overflow in wazuh-analysisd, disrupting log analysis and alerting across the Wazuh deployment.

Affected Products

Wazuh 3.8.0 through 4.10.x
wazuh-analysisd component (XML EventChannel parser)
Wazuh manager deployments ingesting Windows EventChannel logs

Discovery Timeline

2025-09-27 - CVE-2025-59938 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59938

Vulnerability Analysis

The vulnerability resides in the XML parsing logic inside wazuh-analysisd, the daemon responsible for correlating and analyzing events received from Wazuh agents. When the daemon processes Windows EventChannel messages, it parses XML elements without correctly enforcing buffer boundaries on the heap. Malformed or oversized XML content causes a write past the allocated buffer, corrupting heap memory. The condition is classified as a Heap-Based Buffer Overflow [CWE-122]. Successful exploitation halts event processing, which suppresses subsequent detections and alerts across the monitored environment.

Root Cause

The root cause is missing bounds checking during XML element extraction from EventChannel payloads. The parser writes attacker-controlled content into a fixed-size heap allocation without validating the source length. This pattern allows adjacent heap metadata and objects to be overwritten when the input exceeds the expected size.

Attack Vector

The attack vector is network-based and requires low privileges, consistent with an authenticated Wazuh agent enrollment or a foothold that permits sending EventChannel messages to the manager. The attacker crafts a Windows EventChannel log containing malformed XML and forwards it to wazuh-analysisd. Parsing the payload triggers the overflow and causes the daemon to abort. Impact is limited to availability of the analysis pipeline; confidentiality and integrity are not directly affected.

No verified proof-of-concept code has been published. Technical details are available in the vendor advisory: GitHub Security Advisory GHSA-vw3r-mjg3-9hh2.

Detection Methods for CVE-2025-59938

Indicators of Compromise

Unexpected termination or repeated restarts of the wazuh-analysisd process on Wazuh managers
Gaps in alert generation coinciding with EventChannel log ingestion from a specific agent
Core dumps or segmentation fault entries referencing wazuh-analysisd in /var/ossec/logs/ossec.log
Windows EventChannel messages containing malformed or unusually large XML elements

Detection Strategies

Monitor process health of wazuh-analysisd and alert on abnormal exit codes or crash loops
Inspect agent-forwarded EventChannel payloads for oversized XML fields or invalid structures
Baseline agent event volume and flag agents suddenly producing malformed Windows logs

Monitoring Recommendations

Ship ossec.log and system journal entries to a central SIEM for correlation of daemon crashes with agent activity
Track the version of Wazuh managers across the fleet and alert on any instance running 3.8.0 through 4.10.x
Review agent registration events and revoke agents exhibiting anomalous EventChannel traffic

How to Mitigate CVE-2025-59938

Immediate Actions Required

Upgrade all Wazuh managers to version 4.11.0 or later
Audit registered agents and remove keys for any agent that is no longer trusted
Restrict network access to the manager so only authorized agents can send events

Patch Information

The vulnerability is fixed in Wazuh 4.11.0. Apply the vendor-supplied release as documented in the GitHub Security Advisory GHSA-vw3r-mjg3-9hh2. Restart the wazuh-manager service after upgrading to ensure the patched wazuh-analysisd binary is loaded.

Workarounds

If immediate patching is not possible, limit Windows EventChannel ingestion to trusted agents only
Enforce mutual authentication and TLS on agent-manager communication to reduce exposure
Monitor and automatically restart wazuh-analysisd to maintain availability until the upgrade completes

bash

# Verify Wazuh manager version and upgrade
/var/ossec/bin/wazuh-control info
# On Debian/Ubuntu
apt-get update && apt-get install --only-upgrade wazuh-manager
# On RHEL/CentOS
yum update wazuh-manager
systemctl restart wazuh-manager