EUVD-2026-26272Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionGitHub Advisory
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.
Analysis
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.
Technical ContextAI
The vulnerability is in parse_uname_string() (src/shared/remoted_op.c), which parses OS identification data sent by agents to the Wazuh manager daemon (wazuh-remoted). In four separate locations the code strips trailing delimiters using:
// Vulnerable (4 instances):
*(osd->os_version + strlen(osd->os_version) - 1) = '\0';
*(osd->os_codename + strlen(osd->os_codename) - 1) = '\0';
*(osd->os_name + strlen(osd->os_name) - 1) = '\0';
*(str_tmp + strlen(str_tmp) - 1) = '\0';Since strlen() returns size_t (unsigned), when the string is empty strlen() returns 0 and 0 - 1 wraps to SIZE_MAX (CWE-191 unsigned integer underflow). Writing to ptr + SIZE_MAX via pointer arithmetic lands at ptr[-1] — one byte before the heap-allocated buffer — corrupting glibc malloc's internal chunk size metadata (CWE-124 buffer underwrite).
PR #34658 fixes all four instances by adding length guards:
// Fixed:
size_t ver_len = strlen(osd->os_version);
if (ver_len > 0 && osd->os_version[ver_len - 1] == ']') osd->os_version[ver_len - 1] = '\0';
size_t cod_len = strlen(osd->os_codename);
if (cod_len > 0 && osd->os_codename[cod_len - 1] == ')') osd->os_codename[cod_len - 1] = '\0';
size_t name_len = strlen(osd->os_name);
if (name_len > 0 && osd->os_name[name_len - 1] == ']') osd->os_name[name_len - 1] = '\0';RemediationAI
Upgrade Wazuh to version 4.14.4 or later (released 2026-03-17, GitHub release tag v4.14.4). This release patches all four vulnerable strlen-1 patterns in parse_uname_string() via PR #34658. If immediate upgrade is not feasible, restrict which endpoints can register as agents by applying network-level access controls on the agent registration port (default TCP/UDP 1514) to limit the pool of potential attackers. Monitor for unexpected wazuh-remoted process crashes as an indicator of exploitation attempts.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial o
NDJSON injection in Wazuh Manager before 5.0.0-beta3 lets any enrolled agent smuggle arbitrary OpenSearch bulk operation
Wazuh is a free and open source platform used for threat prevention, detection, and response. Rated critical severity (C
Privilege escalation in Wazuh Manager versions 3.9.0 through 4.14.2 allows authenticated cluster nodes to achieve unauth
Wazuh Manager (4.4.0 through 4.14.3) contains a path traversal vulnerability in the cluster synchronization routine that
Wazuh is a security detection, visibility, and compliance open source project. Rated high severity (CVSS 8.8), this vuln
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code exe
Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today