Heap-based buffer overflow in Wazuh agent syscheck registry wildcard expansion (CVE-2026-40106)

A heap-based buffer overflow exists in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards, the agent allocates a fixed 256-byte heap buffer and performs unsafe string concatenation without bounds checking, allowing a low-privileged local attacker to trigger an out-of-bounds write by creating a registry subkey with a maximum-length name. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, exploitation can result in a silent Denial of Service or potentially Local Privilege Escalation. Affected versions: - >=4.6.0 We recommend updating to: >=4.14.5. CVSS 7.8 · our assessment: this_week Vendor advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc Details: https://vuln.today/cve/CVE-2026-40106