Wazuh EUVD-2026-26259

Exploitation requires all of the following: (1) The attacker must have already compromised a Wazuh agent and have privileges sufficient to write to or inject content into the alerts log file monitored by wazuh-logcollector on that host - the CVSS vector AV:L/PR:H directly encodes these prerequisites. (2) The wazuh-logcollector component must be running and actively monitoring the target log file. (3) The Wazuh installation must be on a version between 1.0.0 and 4.14.3 inclusive. This vulnerability cannot be exploited remotely or against a default configuration without a prior agent-level compromise - it is not an initial access vector. The key limiting factors are the requirement for local high-privilege access (AV:L/PR:H) and the need for a prior foothold, which substantially narrows the realistic attacker population to post-breach actors or malicious insiders. There is no confidentiality or integrity impact; the only achievable outcome is availability disruption (crash/DoS) of the monitoring process.

The CVSS 3.1 score of 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H accurately encodes the significant prerequisites: local system access and high privileges are required, the scope is unchanged, and only availability is impacted. EPSS at 0.01% (2nd percentile) places this well below the threshold of actively leveraged vulnerabilities. SSVC signals are consistent - Exploitation: poc (not confirmed active), Automatable: no (requires prior agent compromise), Technical Impact: partial (crash/DoS only). The absence of a CISA KEV entry further confirms no verified in-the-wild exploitation. Critically, this vulnerability cannot serve as an initial access vector: an attacker must already control a compromised Wazuh agent and have privileges sufficient to manipulate the monitored log file. The real-world threat is an insider or post-breach actor attempting to blind or destabilize the security monitoring infrastructure by crashing the wazuh-logcollector or manager process. Defenders should treat this as a medium-priority patch item, not an emergency, unless agent compromise is already suspected.

An attacker who has gained control of a Wazuh agent host - for example, through a separate vulnerability or insider access - crafts a malformed alert entry and writes it to the alerts log file being monitored by wazuh-logcollector. When wazuh-logcollector processes the entry and passes it to GetAlertData, an unsigned integer underflow occurs during buffer size computation, and a NULL byte is written one byte before the heap-allocated buffer, corrupting the preceding allocator metadata block. The resulting heap corruption causes the wazuh-manager or agent process to crash, effectively disabling the security monitoring pipeline for the affected deployment. A POC is indicated by SSVC classification but was not directly linked in the available references.