EUVD-2026-26259Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Local access and high privileges are required to write crafted alerts to logcollector-monitored files; scope is unchanged and only availability (process crash) is impacted.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4.
AnalysisAI
Heap-based buffer underwrite in Wazuh's GetAlertData function (versions 1.0.0 through 4.14.3) allows a threat actor who has already compromised a Wazuh agent to corrupt heap metadata on the manager or agent host by injecting a specially crafted alert into the log file monitored by wazuh-logcollector. The root cause is an unsigned integer underflow combined with pointer arithmetic wrapping that causes a NULL byte write exactly one byte before the start of a strdup-allocated buffer, corrupting adjacent heap metadata. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies a POC as existing; EPSS at 0.01% (2nd percentile) reflects very low observed exploitation probability, and a vendor-released patch is available in version 4.14.4.
Technical ContextAI
The affected product is the Wazuh open-source SIEM and XDR platform (CPE: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*), versions 1.0.0 through 4.14.3. The vulnerable code path resides in the GetAlertData function, which is exercised by the wazuh-logcollector component when parsing entries from alert log files. CWE-124 (Buffer Underwrite / Buffer Underflow) describes the root cause precisely: a size calculation involving an unsigned integer underflows to a very large positive value, and subsequent pointer arithmetic wraps around so that the write target lands at offset -1 from the buffer returned by strdup. Writing a NULL byte there corrupts the allocator's heap metadata block that immediately precedes the allocation, which can destabilize the heap and cause process crashes or undefined behavior in subsequent heap operations. The fix was confirmed via GitHub PRs #34501 (agent side) and #34658 (manager side) included in the v4.14.4 release.
RemediationAI
Upgrade to Wazuh 4.14.4, which resolves the heap-based NULL write buffer underflow in GetAlertData via PRs #34501 (agent) and #34658 (manager), as documented in the official release at https://github.com/wazuh/wazuh/releases/tag/v4.14.4. If immediate upgrade is not possible, the most effective compensating control is to harden agent trust boundaries: ensure that only cryptographically authenticated, known-good agents are permitted to submit data to the manager, and implement file integrity monitoring on the alerts log files to detect unexpected modifications. Restricting write access to the logcollector-monitored log directories to only the wazuh process account reduces the surface for a compromised agent to inject crafted content, though this does not eliminate the risk if the agent process itself is compromised. Disabling wazuh-logcollector entirely would block the attack path but would also eliminate log collection capability - this trade-off is only acceptable in environments where rapid patching is infeasible and the monitoring gap can be covered by an alternative solution.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today