EUVD-2026-45089Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Agent communicates over network (AV:N), enrollment credential suffices as low privilege (PR:L), and wazuh-remoted crash fully eliminates agent visibility for the entire deployment (A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents from the manager. A second code path reached by the same underflow may allow heap memory corruption. This issue has been fixed in version 4.14.5.
AnalysisAI
Remote denial-of-service and potential heap corruption in the Wazuh manager's wazuh-remoted daemon allows any enrolled agent to crash the manager's agent-communication process, instantly severing all agent connections across the entire deployment. Affected versions span 3.0.0 through 4.14.4; a secondary code path triggered by the same underflow may permit heap memory write primitives beyond pure DoS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation barrier - any enrolled agent suffices - makes it a meaningful insider or supply-chain risk for Wazuh-dependent SOC environments.
Technical ContextAI
The defect resides in os_crypto/shared/msgs.c at line 389 within the Wazuh manager codebase, classified as CWE-122 (Heap-based Buffer Overflow). The root cause is a size_t integer underflow: because size_t is an unsigned type, subtracting a larger value from a smaller one wraps around to a very large integer, which is then used as a memory allocation or copy size, corrupting heap state. The affected process, wazuh-remoted, is the single daemon that brokers all agent-to-manager communications; its crash therefore atomically disconnects every enrolled agent. CPE cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* confirms the scope covers all Wazuh releases from 3.0.0 onward until the fix in 4.14.5. The secondary code path reaching the same underflow is described by the vendor as potentially enabling heap memory corruption, which could in theory support a code-execution primitive, though this is not yet independently confirmed.
RemediationAI
Upgrade Wazuh manager to version 4.14.5, which contains the official fix per vendor advisory GHSA-jv5r-5p7c-g9fq at https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5r-5p7c-g9fq. Prior to patching, the most effective compensating control is to audit and minimize the enrolled agent population - revoke credentials for any agent that is decommissioned or untrusted, since the attack requires an enrolled agent identity. Network segmentation that enforces agent-to-manager traffic only from known, managed IP ranges reduces exposure to external compromise of agent keys but does not protect against insider or already-compromised endpoint scenarios. Monitoring wazuh-remoted process health and alerting on unexpected restarts can provide early detection of exploitation attempts, though this monitoring will itself be disrupted during an active attack.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl comman
Path-traversal-driven root code execution affects the Wazuh security platform's cluster synchronization layer in version
Arbitrary file read in Wazuh cluster deployments (4.0.0 through 4.14.5, and 5.0.0-beta1/beta2) lets a peer node that alr
Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running v
A critical deserialization vulnerability in Wazuh's cluster mode allows attackers with access to any worker node to achi
Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or dele
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa
Cluster key disclosure in Wazuh Manager versions 4.0.0 through 4.14.4 enables a two-stage privilege escalation: a low-pr
CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that al
Argument injection in Wazuh active response scripts (versions 4.2.0-4.14.6) allows a low-privileged network attacker who
Cluster secret exposure in Wazuh 4.14.0-4.14.6 stems from a logic inversion in the RBAC masking gate that counterintuiti
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today