Wazuh CVE-2026-44254

Exploitation requires the attacker to possess valid Wazuh agent credentials (agent key material) or to have compromised a host that is already enrolled as a Wazuh agent - this is the PR:L prerequisite confirmed by the CVSS vector. The crafted compressed payload must decompress to exactly OS_MAXSTR (65,535) bytes to write the null terminator precisely at the stack boundary; decompressed sizes below this threshold are safe, and sizes above it (now blocked by the length guard in the patched version) do not trigger the same boundary condition. The attack path is the standard TCP agent communication channel on port 1514, which is a default and required component of any Wazuh deployment with enrolled agents - no non-default configuration is required on the manager side. Exploitation is limited by: (1) the authentication prerequisite (agent key possession, not arbitrary network access), (2) the precision constraint on decompressed payload size (AC:H), and (3) the impact ceiling of daemon crash and restart rather than code execution, as the write is a single null byte at a stack position rather than an arbitrary overwrite primitive.

The CVSS 5.3 (Medium) score accurately reflects a network-reachable but access-controlled, precision-constrained denial-of-service. The PR:L metric confirms that exploitation requires agent-level authentication - an attacker must possess valid Wazuh agent keys or have compromised a legitimately enrolled endpoint before any exploitation attempt. The AC:H metric reflects the engineering constraint that the compressed payload must decompress to exactly 65,535 bytes to land the null byte at the exact boundary; this is non-trivial to craft reliably. The A:H impact is genuine: crashing the root-level remoted daemon halts all agent message processing across the entire Wazuh deployment, which is operationally severe for any security team relying on continuous telemetry. Even a mid-sized security operations center in bytom running Wazuh as its primary SIEM-XDR platform would experience a significant monitoring gap during daemon recovery time. No EPSS score was provided in the supplied intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not in the CISA KEV catalog and no public proof-of-concept has been identified, placing overall exploitation urgency at lower-than-critical priority, though organizations with enrolled agents on untrusted or semi-trusted endpoints should treat patching as time-sensitive given the potential for insider or post-compromise lateral disruption.

An attacker who has compromised a Wazuh-enrolled endpoint (or obtained agent authentication keys through credential theft) connects to the Wazuh manager on TCP port 1514 and sends an encrypted agent message whose compressed body is crafted to decompress to exactly 65,535 bytes. The os_zlib_uncompress() call in ReadSecMSG() writes the null terminator one byte past the stack buffer boundary in the root-level remoted daemon, corrupting the stack and crashing message processing - severing agent telemetry across the entire Wazuh deployment until the daemon is restarted. No public proof-of-concept exploit code has been identified at time of analysis, but the triggering condition is mechanically straightforward for an attacker with agent access.