Wazuh CVE-2026-32984

This vulnerability presents low real-world risk despite its network accessibility. The CVSS v3.1 score of 3.5 reflects a low severity rating driven by several mitigating factors: (1) Requires Low Privilege authentication (PR:L), eliminating unauthenticated remote attack surface; (2) Requires User Interaction (UI:R), meaning the user must perform an action for exploitation; (3) Scope is Unchanged (S:U), limiting blast radius to the authd process itself; (4) Impact is Availability only (A:L), with no Confidentiality or Integrity impact, meaning no data exfiltration or privilege escalation potential. The lack of a publicly available exploit code or CISA KEV designation further reduces exploitation likelihood. While the vulnerability is automatable in principle (heap overflows are generally not human-dependent once triggered), the authentication barrier and user interaction requirement significantly narrow the attack surface. This should be treated as a moderate-priority patch for availability-sensitive deployments rather than an emergency.

An authenticated attacker with valid Wazuh credentials crafts a specially formatted authentication request or enrollment message targeting the authd daemon. When authd processes this malicious input without proper bounds checking, a heap-buffer overflow is triggered, corrupting the authd process memory and causing it to crash or become unresponsive. This results in temporary denial of authentication services for legitimate Wazuh agents attempting to enroll or renew credentials, disrupting monitoring operations until the daemon is restarted. The attack requires network access to the authd port and valid authentication credentials, making it suitable for insider threats or attackers who have compromised a Wazuh agent account.