Wazuh
CVE-2026-40106
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryIdentify wildcard-monitored registry path
-
ExploitCreate 255-char registry subkey under it
-
ExecutionAgent expands path, overflows 256-byte heap buffer
-
PersistCorrupt SYSTEM-level agent memory
-
ImpactCrash agent (DoS) or escalate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local, authenticated access to a Windows host running an affected Wazuh agent (4.6.0-4.14.4), and - critically - the agent must be configured to monitor a registry path using wildcard characters (* or ?) in its syscheck/FIM configuration. The attacker must be able to create a registry subkey with a maximum-length (255-character) name inside that monitored path. Limiting factors: this is not remotely exploitable (AV:L), it requires the specific wildcard registry-monitoring configuration to be present, it affects only the Windows agent build, and reliable privilege escalation (versus a mere DoS crash) is described only as a potential outcome, not a guaranteed one. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, low-privilege attack with high CIA impact - the high impact reflects the potential SYSTEM-level LPE outcome, while the reliably demonstrated outcome is a DoS that blinds the security agent. Corroborating signals point to a genuine-but-not-urgent priority: EPSS is 0.09% (1st percentile) and SSVC rates it Exploitation=poc, Automatable=no, Technical Impact=partial, all of which align with the AV:L requirement - an attacker must already have local, authenticated access, so this is not a mass-exploitable internet-facing bug. The main tension in the data is between the 'High' CIA metrics and the description's own hedging: DoS is described as achievable while privilege escalation is only 'potentially' possible, so the C:H/I:H ratings hinge on an LPE that is not confirmed to be reliably exploitable. Realistically this is a defense-evasion/persistence enabler (silence the SYSTEM-level monitoring agent) more than a turnkey code-execution primitive; treat as a meaningful but second-tier patch priority, especially in environments where local users are semi-trusted. |
| Exploit ScenarioDerived | A low-privileged user (or malware running in a standard-user context) on a Windows host running the Wazuh agent creates a registry subkey with a 255-character name inside a registry path that the agent monitors with a wildcard rule. When syscheck expands the wildcard and concatenates the long subkey name into its 256-byte heap buffer, the out-of-bounds write crashes or corrupts the SYSTEM-level agent process, silently disabling monitoring and potentially opening a path to SYSTEM-level code execution. Proof-of-concept exploit code is reported to exist (SSVC: poc). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 20, 2026
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
Earlier versions of this analysis (1)
Heap-based buffer overflow in the Wazuh agent for Windows (versions 4.6.0 through 4.14.4) allows a low-privileged local attacker to corrupt heap memory by placing a maximum-length registry subkey name under a syscheck-monitored wildcard path, exploiting a fixed 256-byte allocation in the wildcard expansion routine. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, successful exploitation can silently crash the security agent - creating a detection blind spot - or potentially escalate attacker privileges to SYSTEM level. No public exploit has been identified at time of analysis; the vendor released a fix in version 4.14.5.
RemediationAI
Vendor-released patch: 4.14.5 - upgrade all Windows Wazuh agents to 4.14.5 or later, which fixes the heap overflow in the syscheck registry expansion logic, per advisory GHSA-qvrc-pcfc-jhqc (https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc). Where immediate patching is not possible, a targeted workaround is to remove or narrow wildcard-containing registry entries (paths with * or ?) from the agent's syscheck/FIM configuration so the vulnerable expansion path is not exercised; the trade-off is reduced registry integrity-monitoring coverage on those keys. As a complementary control, restrict the ability of low-privileged users to create arbitrary registry subkeys within monitored hives (tighten registry ACLs), noting this may interfere with legitimate applications that write under those keys. These are compensating controls only - upgrading to 4.14.5 is the definitive fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Wazuh's File Integrity Monitoring/syscheck subsystem, specifically the Windows registry monitoring path expansion logic. When a monitored registry path contains wildcard characters (* or ?), the agent expands matching subkeys by concatenating strings into a fixed-size heap buffer allocated at 256 bytes (the OS_SIZE_256 constant). Windows registry key names may be up to 255 characters, so concatenating a maximum-length subkey name onto an existing path prefix overruns the 256-byte allocation. This is a classic CWE-122 heap-based buffer overflow: the root cause is an unchecked/insufficiently-bounded string concatenation into an undersized heap allocation rather than dynamically sizing the destination. The affected component (cpe:2.3:a:wazuh:wazuh) is the endpoint agent, and only the Windows build is implicated because the trigger is Windows registry subkey creation.
Know when Wazuh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user triggers the crash (AV:L/AC:L/PR:L/UI:N); A:H is solid for the DoS, and C:H/I:H reflect the potential SYSTEM-level LPE against the agent process.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed-size heap buffer of 256 bytes (OS_SIZE_256). By creating a registry subkey with a maximum allowed length (255 characters) inside a monitored path, a low-privileged local attacker can force an out-of-bounds write during string concatenation. Since wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, this can lead to a silent Denial of Service (blinding the agent) or potentially Local Privilege Escalation (LPE). This issue has been fixed in version 4.14.5.
Executive ViewAI
Wazuh Windows agent versions 4.6.0-4.14.4 contain a local privilege escalation vulnerability that can silently disable security monitoring or enable code execution with SYSTEM privileges. This directly undermines security visibility on affected systems, allowing attackers with local access to either blind threat detection or execute code with highest privileges.
No vendor-released patch identified at time of analysis. Restrict local administrator privileges on affected systems; monitor registry operations for creation of unusually long subkeys (≥255 characters) under Wazuh-monitored paths; enable application allowlisting to prevent arbitrary code execution; implement process monitoring with immediate alerts on Wazuh agent crashes; segment affected systems to minimize exposure to untrusted users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Wazuh Agent before 4.13.0 on Windows can be made by an authenticated, high-privileged configuration writer to open attac
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Unauthenticated remote denial of service in the Wazuh cluster daemon (wazuh-clusterd) allows a network peer to exhaust p
Exploit-DB