Wazuh CVE-2026-44251

The attacker must possess a valid Wazuh agent enrollment credential - either by controlling a legitimately enrolled agent or by stealing an agent key (CVSS PR:L confirms low-privilege enrolled-agent access is required; unauthenticated remote attackers cannot trigger this). The manager must be running Wazuh 3.0.0 through 4.14.4. No non-default configuration is required; the underflow exists in the standard agent-manager message processing path that is active in all default deployments. Exploitation is limited by the enrolled-agent requirement: external attackers without access to an enrolled agent or its credentials cannot reach the vulnerable code path. Post-crash, the wazuh-remoted service may restart automatically (depending on deployment configuration), potentially allowing repeated triggering to maintain a persistent DoS condition.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5, which appropriately reflects the primary availability impact: a network-accessible crash with minimal complexity requiring only enrolled-agent credentials. The S:U (scope unchanged) and C:N/I:N ratings are conservative given the secondary heap corruption path; if that path proves exploitable for code execution, integrity and confidentiality scores would need revision upward. No EPSS score was provided in the input data, making probabilistic exploitation forecasting impossible from this dataset. The absence of a KEV listing and lack of known public POC suggest exploitation has not been observed at scale, but the low barrier - any single enrolled agent, legitimate or compromised, can trigger the crash - means the attack is accessible to insider threats or attackers who have compromised one endpoint in a monitored estate. The multiplier effect (one agent crash kills visibility for all agents) elevates real-world priority above what the 6.5 base score alone implies for Wazuh-dependent security operations.

An attacker who has compromised a single Wazuh-monitored endpoint - or who has exfiltrated an agent enrollment key - sends a crafted message to the Wazuh manager that triggers the size_t underflow in msgs.c:389, crashing wazuh-remoted. All other agents immediately lose connectivity to the manager, creating a monitoring blackout across the entire Wazuh deployment that the attacker can exploit to conduct further activity undetected. If the secondary heap corruption path is exploitable, the attacker may additionally achieve code execution on the manager itself, escalating from DoS to full manager compromise.