CVE-2025-64169: Critical Vulnerability in Wazuh Could Cause Analysisd Crash

Overview

This article details CVE-2025-64169, a vulnerability affecting Wazuh, a free and open-source platform for threat prevention, detection, and response. Specifically, this vulnerability impacts versions 3.7.0 up to, but not including, version 4.12.0. A maliciously crafted message from a compromised agent could lead to a crash of the analysisd process on the Wazuh manager. It is crucial to update to version 4.12.0 or later to mitigate this risk.

Technical Details

The vulnerability resides within the fim_alert() implementation of Wazuh. The issue stems from a missing null check before dereferencing oldsum->md5. If oldsum->md5 is NULL, attempting to dereference it will result in a segmentation fault, causing the analysisd process to crash. A compromised agent, by sending a specifically crafted message designed to trigger this condition, can exploit this flaw.

CVSS Analysis

Currently, there is no CVSS score assigned to CVE-2025-64169. This is indicated as N/A by the reporting source. While a CVSS score isn’t available, the potential impact of a denial-of-service attack on the analysisd component is significant. A thorough investigation of the vulnerability and potential exploitation complexity is recommended before deploying mitigation techniques.

Possible Impact

The impact of exploiting CVE-2025-64169 is a denial-of-service (DoS) condition. By crashing the analysisd process, a malicious actor can disrupt Wazuh’s core functionality, preventing it from analyzing security events and generating alerts. This leaves the environment unprotected and vulnerable to further attacks until the analysisd process is restarted and the vulnerability is patched.

Mitigation and Patch Steps

The recommended mitigation for CVE-2025-64169 is to upgrade your Wazuh installation to version 4.12.0 or later. This version includes a patch that addresses the missing null check in the fim_alert() implementation. Follow the official Wazuh upgrade documentation to ensure a smooth and successful update process.

1. Backup Your Configuration: Before upgrading, create a backup of your Wazuh configuration files.
2. Download the Latest Version: Download the Wazuh 4.12.0 or later packages from the official Wazuh website.
3. Follow the Upgrade Guide: Refer to the official Wazuh upgrade guide for detailed instructions on how to upgrade your Wazuh manager and agents.
4. Verify the Upgrade: After the upgrade, verify that the analysisd process is running correctly and that the vulnerability is no longer present.

References

• CVE ID: CVE-2025-64169
• GitHub Advisory: GHSA-hc35-h924-8596
• Wazuh Official Website: wazuh.com