EUVD-2026-26272Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
AV:N reflects network agent-to-manager path; PR:L reflects required agent authentication; I:L added over vendor rating to acknowledge potential heap metadata integrity impact beyond pure DoS.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.
AnalysisAI
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
Technical ContextAI
Wazuh is an open-source SIEM and XDR platform built on a manager-agent architecture. The vulnerable function parse_uname_string() resides in remoted_op.c within the manager's remoted daemon, which processes agent-submitted OS identification telemetry over the network. The root cause is CWE-124 (Buffer Underwrite / Buffer Underflow): the function writes to index strlen(ptr)-1 in four separate locations without first checking whether the input string is empty. When an agent submits an empty OS identification field, strlen() returns 0, and subtracting 1 from an unsigned size_t underflows to SIZE_MAX (0xFFFFFFFFFFFFFFFF on 64-bit systems). Pointer arithmetic then wraps this offset back to one byte immediately before the start of the heap-allocated buffer. The resulting single-byte out-of-bounds write targets glibc malloc metadata (e.g., the chunk size field in the preceding chunk header), corrupting the heap allocator's internal bookkeeping structures. CPE cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* covers all Wazuh installations in the affected range.
RemediationAI
Upgrade Wazuh Manager to version 4.14.4, which includes the fix for heap-based null write buffer underflows in the manager (PR #34658) and a related heap-based NULL write buffer underflow fix in agent GetAlertData (PR #34501). The patched release is available at https://github.com/wazuh/wazuh/releases/tag/v4.14.4 and the vendor advisory is at https://github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3. If immediate patching is not feasible, compensating controls include restricting agent registration to known, managed endpoints using Wazuh's agent authentication keys and certificate pinning - this limits the attacker pool to already-trusted agents. Additionally, placing the Wazuh manager behind network segmentation so only authorized agent IP ranges can reach the remoted port (default UDP/TCP 1514) reduces attack surface. Note that these controls reduce exposure but do not eliminate risk from a compromised trusted agent.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attac
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Same weakness CWE-124 – Buffer Underwrite ('Buffer Underflow')
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today