CVE-2026-44251: Wazuh Manager integer underflow in os_crypto message processing

CVE-2026-44251 · Severity: medium · CVSS 6.5 · Published 2026-07-17

Wazuh is a security monitoring platform used to detect and respond to threats across an organization's infrastructure. A vulnerability in the manager component allows a compromised or malicious agent to crash the central monitoring service, causing all other agents to disconnect and leaving the entire environment unmonitored. In some scenarios, this flaw could also lead to memory corruption, potentially allowing an attacker to gain further control over the security manager.

Technologies: Wazuh Manager. Vendors: Wazuh.

Quick answers

Is CVE-2026-44251 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44251 being exploited in the wild.
How severe is CVE-2026-44251?
Medium severity, with a CVSS score of 6.5, published 17 July 2026.
Which products and versions are affected?
Wazuh Manager >= 3.0.0, < 4.14.5.
Is there a fix for CVE-2026-44251?
A patch was published on 2026-07-16: Fixed in version 4.14.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44251 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44251?
Check whether you run Wazuh Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A size_t integer underflow exists in os_crypto/shared/msgs.c within the ReadSecMSG function. The code advances a pointer by 53 bytes without verifying that the decompressed message meets this minimum length requirement, leading to a wrap-around when calculating the remaining size. This results in a massive value being passed to memory allocation routines; specifically, os_calloc may receive a near-maximum size_t value, return NULL, and trigger a process exit (DoS). Alternatively, if the payload reaches req_update, a heap-based buffer overflow may occur during a memcpy operation if malloc(0) returns a valid pointer. Exploitation requires a valid enrolled agent ID and encryption key but no administrative privileges.

Affected products

  • Wazuh Wazuh Manager >= 3.0.0, < 4.14.5

Timeline

  • 2026-07-16: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: NVD publication date
  • 2026-07-16: patched: Fixed in version 4.14.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.