Executive brief
Wazuh is a security platform used to monitor and protect computers from threats. A flaw in the Windows version of the Wazuh agent allows a standard user on a computer to crash the security software by creating a specially named registry key. This can be used to disable security monitoring on the device or potentially allow the user to gain full administrative control over the system.
Technical details
A heap-based buffer overflow (CWE-122) exists in the syscheck component of the Wazuh agent for Windows within the w_expand_by_wildcard function in syscheck_op.c. The vulnerability occurs because the agent allocates a fixed 256-byte buffer (OS_SIZE_256) to store expanded registry paths but fails to validate the length of the resulting string when processing wildcards (* or ?). A local attacker with low privileges can create a registry subkey with the maximum allowed length (255 characters) in a monitored path, causing an out-of-bounds write during string concatenation. Because the agent runs with NT AUTHORITY\SYSTEM privileges, this can result in a Denial of Service (DoS) via process crash or potential Local Privilege Escalation (LPE). The issue is fixed in version 4.14.5.
Affected products
- Wazuh Wazuh Agent >= 4.6.0, < 4.14.5
Timeline
- 2026-07-16: advisory: GitHub Security Advisory GHSA-qvrc-pcfc-jhqc published
- 2026-07-17: disclosed: NVD publication date