# CVE-2026-34150: Wazuh Manager heap buffer overflow in wazuh-analysisd

Source: https://junglewise.ai/threats/cve-2026-34150-wazuh-manager-heap-buffer-overflow-in-wazuh-analysisd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-34150 · Severity: high · CVSS 7.5 · Published 2026-07-17

Wazuh is an open-source security platform used by organizations to monitor for threats and manage security alerts. A vulnerability in the system's analysis engine allows an unauthenticated attacker to remotely crash the service, effectively blinding the security team to new threats. While the management dashboard may appear functional, it will only display old data, and no new security alerts will be processed until the system is patched and restarted.

Technologies: [Wazuh Manager](https://junglewise.ai/threats/technologies/wazuh-manager). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-34150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34150 being exploited in the wild.

**How severe is CVE-2026-34150?** High severity, with a CVSS score of 7.5, published 17 July 2026.

**Which products and versions are affected?** Wazuh Manager >= 1.0.0, < 4.14.5.

**Is there a fix for CVE-2026-34150?** A patch was published on 2026-07-16: Fix released in version 4.14.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34150 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-34150?** Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the 'W_JSON_ParseRootcheck' function within 'wazuh-analysisd'. The vulnerability is triggered when the engine parses rootcheck events containing JSON-like '{key: value}' patterns. The code allocates a fixed 30-byte buffer but uses 'sprintf' to write unbounded regex matches into it, leading to heap corruption. In default configurations (specifically the official Docker deployment), unauthenticated agent enrollment is enabled, allowing an attacker to obtain valid encryption keys via 'authd' and subsequently inject malicious events via 'remoted'. An exploit results in the silent termination of the analysis engine while the API and dashboard remain active, displaying stale data. The issue is resolved in version 4.14.5.

## Affected products

- Wazuh Wazuh Manager >= 1.0.0, < 4.14.5

## Timeline

- 2026-07-16: advisory: GitHub Security Advisory GHSA-rvr9-89q8-w883 published
- 2026-07-17: disclosed: CVE-2026-34150 published to NVD
- 2026-07-16: patched: Fix released in version 4.14.5

## References

- [https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883](https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883)

## Related threats

- [Wazuh Manager SQL injection in WazuhDBBackend._substitute_params](https://junglewise.ai/threats/cve-2026-112341-wazuh-versions-from-4-0-0-before-4-14-9-contain-a-sql-injection)
- [Wazuh missing TLS hostname verification in fluent-forward module](https://junglewise.ai/threats/cve-2026-112339-wazuh-from-3-9-0-before-4-14-9-contains-a-missing-tls-hostname)
- [Wazuh GitHub module server-side request forgery in pagination](https://junglewise.ai/threats/cve-2026-112338-wazuh-from-4-3-0-before-4-14-9-contains-a-server-side-request)
- [Wazuh Manager memory leak in JSON decoder](https://junglewise.ai/threats/cve-2026-112336-wazuh-manager-from-3-0-0-before-4-14-9-contains-a-memory-leak)
- [Wazuh path traversal in get_list_file helper](https://junglewise.ai/threats/cve-2026-93347-wazuh-from-4-1-1-before-4-14-8-contains-a-path-traversal)