EUVD-2026-26270Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Pre-auth stack overflow can crash wazuh-remoted and log amplification exhausts disk; A:H reflects both paths; AC:L since signed char is default on common Linux toolchains; no confidentiality impact documented.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For input bytes such as 0xFF, the formatting can emit "ffffffff" (8 chars) instead of "ff" (2 chars), causing an out-of-bounds write past a fixed 2049-byte stack buffer. The vulnerable path is reachable remotely prior to any agent authentication/registration logic via TCP/1514 when an oversized length prefix causes the “unexpected message (hex)” diagnostic path to run. Additionally, the same unauthenticated oversized-message diagnostic path logs an attacker-controlled hex dump to /var/ossec/logs/ossec.log for each trigger, allowing remote log amplification that can degrade monitoring fidelity and consume disk/I/O. This log amplification is reachable even without triggering the sign-extension overflow (e.g., using bytes < 0x80). This issue has been patched in version 4.14.4.
AnalysisAI
Stack-based buffer overflow in wazuh-remoted's print_hex_string() function exposes Wazuh 4.8.0 through 4.14.3 to unauthenticated remote exploitation via TCP/1514, reachable before any agent authentication logic executes. The overflow stems from a C signed-char sign-extension defect where bytes ≥ 0x80 are rendered as 8-character hex strings instead of 2, overflowing a fixed 2049-byte stack buffer; a secondary unauthenticated path independently enables remote log amplification capable of exhausting disk and I/O on the monitoring host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though SSVC assesses a proof-of-concept exists and the attack is automatable at scale.
Technical ContextAI
The vulnerability resides in print_hex_string() within wazuh-remoted, the Wazuh daemon that manages agent communication over TCP/1514. The root cause (CWE-121: Stack-based Buffer Overflow) is a C language char signedness defect: the call sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) passes a char to a variadic function; on platforms where char is signed by default (x86 and ARM with GCC or Clang without -funsigned-char), bytes ≥ 0x80 are sign-extended to a full negative int before formatting, causing %x to emit the entire 32-bit representation - for example, 0xFF becomes "ffffffff" (8 chars) rather than "ff" (2 chars). The fixed-size stack buffer of 2049 bytes is exhausted when sufficiently many high bytes appear in the input. The vulnerable diagnostic path is triggered when an oversized length prefix causes an "unexpected message" condition, and it executes before any agent authentication or registration check. A secondary issue allows any unauthenticated sender - even using only bytes < 0x80 - to inject attacker-controlled hex strings into /var/ossec/logs/ossec.log, enabling log amplification without triggering the overflow itself. Affected CPE: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* versions 4.8.0 to 4.14.3. The patch (PR #34602) resolves the root cause by changing the buffer parameter to unsigned char, eliminating sign extension.
RemediationAI
Upgrade Wazuh to version 4.14.4, confirmed by vendor release notes and advisory GHSA-q9vv-7w4c-f4cm at https://github.com/wazuh/wazuh/releases/tag/v4.14.4; the specific fix in PR #34602 changes print_hex_string() to use unsigned char, eliminating the sign-extension defect and resolving both the overflow and amplification paths. If immediate patching is not feasible, restrict inbound TCP/1514 access at the network or host firewall to only known agent IP addresses, removing unauthenticated reachability of the vulnerable diagnostic path for external attackers - note that overly broad rules here can disrupt agent-to-manager communication, so coordinate with your agent fleet before applying. As a secondary compensating control, configure log rotation and disk quotas on /var/ossec/logs/ossec.log to bound the impact of log amplification; this does not prevent the overflow path but limits the availability impact of the amplification primitive. No control short of network-layer access restriction fully eliminates the unauthenticated overflow risk without patching.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node,
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
Arbitrary file deletion on a Wazuh manager via the cluster synchronization protocol allows a cluster-authenticated attac
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today