CVE-2025-64169: Wazuh Buffer Overflow Vulnerability

CVE-2025-64169 Overview

CVE-2025-64169 affects Wazuh, an open source platform for threat prevention, detection, and response. The vulnerability exists in the fim_alert() implementation, which fails to check whether oldsum->md5 is NULL before dereferencing the pointer. A compromised Wazuh agent can trigger a crash of the analysisd process on the Wazuh manager by sending a specially crafted message. The flaw is tracked under [CWE-476] (NULL Pointer Dereference) and [CWE-252] (Unchecked Return Value). Versions from 3.7.0 up to but not including 4.12.0 are affected. The issue is patched in version 4.12.0.

Critical Impact
A compromised agent can crash the central analysisd component on the Wazuh manager, disrupting alert correlation and detection across the monitored fleet.

Affected Products

Wazuh versions 3.7.0 through 4.11.x
Wazuh manager component (analysisd)
Fixed in Wazuh 4.12.0

Discovery Timeline

2025-11-21 - CVE-2025-64169 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64169

Vulnerability Analysis

The vulnerability resides in the fim_alert() function within the Wazuh manager's analysisd daemon. This function processes File Integrity Monitoring (FIM) events forwarded from Wazuh agents. When constructing an alert, the code compares checksum fields between the previous and current file state through the oldsum structure.

The implementation dereferences oldsum->md5 without first verifying that the pointer is non-NULL. An attacker controlling a Wazuh agent can craft a FIM message that omits or nullifies the MD5 field. When analysisd processes this message, the dereference triggers a segmentation fault and terminates the process.

Because analysisd is the central correlation engine on the manager, its termination halts alert generation across all monitored endpoints reporting to that manager. This produces a denial-of-service condition affecting detection coverage rather than data confidentiality or integrity.

Root Cause

The root cause is a missing NULL check on the oldsum->md5 pointer before dereference in the fim_alert() code path. The function assumes upstream parsing populates all checksum members, an assumption that fails when a malicious or compromised agent sends messages that violate the expected schema.

Attack Vector

Exploitation requires a compromised or malicious Wazuh agent already enrolled with the manager, which corresponds to the high privileges requirement (PR:H) in the CVSS v4.0 vector. The attacker sends a specially crafted FIM event over the standard agent-manager channel. No user interaction is needed, and the attack executes over the network. See the GitHub Security Advisory GHSA-hc35-h924-8596 for the vendor description.

No public proof-of-concept exploit code is available at time of writing.

Detection Methods for CVE-2025-64169

Indicators of Compromise

Unexpected crashes or restarts of the wazuh-analysisd process on the Wazuh manager
Segmentation fault entries referencing analysisd in /var/ossec/logs/ossec.log or system journal
Gaps in alert ingestion timelines correlated with a specific agent's connection activity
FIM events from a single agent that immediately precede analysisd termination

Detection Strategies

Monitor process supervision logs for repeated restarts of wazuh-analysisd by ossec-control or systemd
Alert on analysisd exit codes indicating abnormal termination (SIGSEGV / signal 11)
Correlate agent message timestamps against manager crash events to identify the source agent
Track Wazuh manager health metrics through the Wazuh API for sudden drops in events-per-second

Monitoring Recommendations

Enable process telemetry collection on Wazuh manager hosts to capture crash signatures
Forward /var/ossec/logs/ossec.log to a centralized log platform for anomaly detection
Baseline normal FIM event volume per agent and alert on deviations that coincide with manager instability

How to Mitigate CVE-2025-64169

Immediate Actions Required

Upgrade all Wazuh manager instances to version 4.12.0 or later
Audit enrolled agents for signs of compromise, focusing on agents with recent unexpected key re-registrations
Rotate agent keys for any endpoint suspected of compromise to prevent reuse of trusted credentials
Review manager crash history to determine whether exploitation attempts have already occurred

Patch Information

Wazuh addressed CVE-2025-64169 in version 4.12.0 by adding a NULL check on oldsum->md5 before dereference in fim_alert(). Refer to the Wazuh GitHub Security Advisory GHSA-hc35-h924-8596 for release details and commit references.

Workarounds

Restrict network access to the Wazuh manager's agent communication ports (default 1514/udp and 1515/tcp) to trusted agent subnets only
Enforce strict agent enrollment policies and disable auto-enrollment where feasible
Configure process supervision to automatically restart wazuh-analysisd to reduce downtime while patching is scheduled
Isolate or disconnect any agent exhibiting anomalous FIM message patterns pending investigation

bash

# Upgrade Wazuh manager on Debian/Ubuntu to the patched version
apt-get update
apt-get install wazuh-manager=4.12.0-1
systemctl restart wazuh-manager

# Verify the running version
/var/ossec/bin/wazuh-control info | grep WAZUH_VERSION