Executive brief
Wazuh is a security monitoring platform used to detect and respond to threats across an organization's infrastructure. A vulnerability in the manager component allows a compromised or malicious agent to crash the central monitoring service, causing all other agents to disconnect and leaving the entire environment unmonitored. In some scenarios, this flaw could also lead to memory corruption, potentially allowing an attacker to gain further control over the security manager.
Technical details
A size_t integer underflow exists in os_crypto/shared/msgs.c within the ReadSecMSG function. The code advances a pointer by 53 bytes without verifying that the decompressed message meets this minimum length requirement, leading to a wrap-around when calculating the remaining size. This results in a massive value being passed to memory allocation routines; specifically, os_calloc may receive a near-maximum size_t value, return NULL, and trigger a process exit (DoS). Alternatively, if the payload reaches req_update, a heap-based buffer overflow may occur during a memcpy operation if malloc(0) returns a valid pointer. Exploitation requires a valid enrolled agent ID and encryption key but no administrative privileges.
Affected products
- Wazuh Wazuh Manager >= 3.0.0, < 4.14.5
Timeline
- 2026-07-16: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: NVD publication date
- 2026-07-16: patched: Fixed in version 4.14.5