Wazuh
CVE-2026-40106
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user triggers the crash (AV:L/AC:L/PR:L/UI:N); A:H is solid for the DoS, and C:H/I:H reflect the potential SYSTEM-level LPE against the agent process.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed-size heap buffer of 256 bytes (OS_SIZE_256). By creating a registry subkey with a maximum allowed length (255 characters) inside a monitored path, a low-privileged local attacker can force an out-of-bounds write during string concatenation. Since wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, this can lead to a silent Denial of Service (blinding the agent) or potentially Local Privilege Escalation (LPE). This issue has been fixed in version 4.14.5.
AnalysisAI
Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.
Technical ContextAI
The flaw lives in Wazuh's File Integrity Monitoring/syscheck subsystem, specifically the Windows registry monitoring path expansion logic. When a monitored registry path contains wildcard characters (* or ?), the agent expands matching subkeys by concatenating strings into a fixed-size heap buffer allocated at 256 bytes (the OS_SIZE_256 constant). Windows registry key names may be up to 255 characters, so concatenating a maximum-length subkey name onto an existing path prefix overruns the 256-byte allocation. This is a classic CWE-122 heap-based buffer overflow: the root cause is an unchecked/insufficiently-bounded string concatenation into an undersized heap allocation rather than dynamically sizing the destination. The affected component (cpe:2.3:a:wazuh:wazuh) is the endpoint agent, and only the Windows build is implicated because the trigger is Windows registry subkey creation.
RemediationAI
Vendor-released patch: 4.14.5 - upgrade all Windows Wazuh agents to 4.14.5 or later, which fixes the heap overflow in the syscheck registry expansion logic, per advisory GHSA-qvrc-pcfc-jhqc (https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc). Where immediate patching is not possible, a targeted workaround is to remove or narrow wildcard-containing registry entries (paths with * or ?) from the agent's syscheck/FIM configuration so the vulnerable expansion path is not exercised; the trade-off is reduced registry integrity-monitoring coverage on those keys. As a complementary control, restrict the ability of low-privileged users to create arbitrary registry subkeys within monitored hives (tighten registry ACLs), noting this may interfere with legitimate applications that write under those keys. These are compensating controls only - upgrading to 4.14.5 is the definitive fix.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today