EUVD-2026-42261
GHSA-h67j-gxv6-33g4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Enrolled agent needed so PR:L; network-reachable message with straightforward crafting gives AV:N/AC:L; impact is availability-only (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventory_sync FlatBuffer DataValue handling. An enrolled agent can send a verifier-valid DataValue message omitting the optional id field, causing wazuh-modulesd to crash when dereferencing data->id()->string_view() without null validation, resulting in denial of service.
AnalysisAI
Denial of service in Wazuh wazuh-modulesd (all releases before 5.0.0-beta3) lets an enrolled agent crash the manager's inventory synchronization module by sending a verifier-valid FlatBuffer DataValue message that omits the optional id field, triggering a null pointer dereference (CWE-476). Exploitation requires only a valid enrolled agent (PR:L) over the network with no user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only - no data confidentiality or integrity loss - but it can repeatedly take down central inventory sync, blinding a security monitoring deployment.
Technical ContextAI
Wazuh is an open-source XDR/SIEM platform whose managers run wazuh-modulesd, the module daemon that handles agent telemetry including the inventory_sync capability. Agents and the manager exchange serialized messages using Google FlatBuffers, a schema-based binary format in which fields can be marked optional. In this flaw the inventory_sync DataValue handler passes the message through FlatBuffer verification (so it is structurally 'valid') but then unconditionally calls data->id()->string_view(). Because the id field is optional in the schema, a message that legitimately omits it makes data->id() return a null accessor, and calling string_view() on that null pointer dereferences it, crashing the process. This is a classic CWE-476 missing-null-check: schema verification confirms structural validity but does not guarantee optional fields are present, so application code must null-check before dereferencing.
RemediationAI
Vendor-released patch: upgrade wazuh-modulesd / Wazuh to 5.0.0-beta3 or later, which adds null validation before dereferencing the optional DataValue id field (fix commit https://github.com/wazuh/wazuh/commit/3adf4f87942705aa0ceeba1e145c259cc9dcd242; advisory GHSA-6hxp-c9x3-qc7p). Because this is a pre-release beta line, organizations on stable 4.x should track the vendor advisory for a backported stable release and apply it when available. As compensating controls until patched, tighten agent enrollment and authentication so untrusted parties cannot register agents (restrict the enrollment/registration service and rotate agent keys if endpoint compromise is suspected), and network-segment the manager so only trusted agent subnets can reach the agent communication port - the trade-off is that overly strict filtering can break legitimate agent reporting and must be scoped to real agent ranges. Monitor for repeated wazuh-modulesd crashes/restarts as a detection signal, since the module's failure itself reduces monitoring coverage.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today