# CVE-2026-45798: Wazuh buffer over-read and stack corruption in version comparison

Source: https://junglewise.ai/threats/cve-2026-45798-wazuh-buffer-over-read-and-stack-corruption-in-version-comparison  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45798 · Severity: high · CVSS 7.5 · Published 2026-08-19

Wazuh is a threat detection and response platform used to monitor and protect enterprise networks. An attacker can send a crafted enrollment message to the authentication daemon before logging in, causing the server to crash or potentially execute unauthorized actions. This remotely accessible vulnerability requires no authentication and can disrupt security monitoring operations.

Technologies: [Wazuh](https://junglewise.ai/threats/technologies/wazuh). Vendors: [Wazuh](https://junglewise.ai/threats/vendors/wazuh).

## Quick answers

**Is CVE-2026-45798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45798 being exploited in the wild.

**How severe is CVE-2026-45798?** High severity, with a CVSS score of 7.5, published 19 August 2026.

**Which products and versions are affected?** Wazuh 4.5.0 through 4.14.5, 5.0.0-beta1.

**Is there a fix for CVE-2026-45798?** A patch was published on 2026-05-13: Fix merged in version 4.14.6 and 5.0.0-beta2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45798 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45798?** Check whether you run Wazuh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a combination of buffer over-read and stack memory corruption in the compare_wazuh_versions() function in src/shared/version_op.c. The function uses strncpy() to copy an attacker-controlled enrollment version field into a 10-byte stack buffer without ensuring NUL-termination; when the input is 9+ non-null bytes, subsequent strchr() and strtok() calls read beyond the buffer boundary and strtok() writes a null byte into adjacent stack memory. The vulnerable code path is reachable unauthenticated through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. An attacker can achieve denial of service by crashing the daemon. The issue is fixed in versions 4.14.6 and 5.0.0-beta2 by explicitly ensuring NUL-termination of string buffers.

## Affected products

- Wazuh Wazuh 4.5.0 through 4.14.5, 5.0.0-beta1

## Timeline

- 2026-08-19: disclosed
- 2026-05-13: patched: Fix merged in version 4.14.6 and 5.0.0-beta2

## References

- [https://github.com/wazuh/wazuh/commit/b6aac379982d6144b8da38450cbea6c8dc15be44](https://github.com/wazuh/wazuh/commit/b6aac379982d6144b8da38450cbea6c8dc15be44)
- [https://github.com/wazuh/wazuh/pull/36059](https://github.com/wazuh/wazuh/pull/36059)

## Related threats

- [Wazuh heap buffer overflow in Windows EventChannel decoder](https://junglewise.ai/threats/cve-2026-62365-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh unauthenticated memory exhaustion in cluster listener](https://junglewise.ai/threats/cve-2026-71540-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh stack exhaustion in XML parser via element attributes](https://junglewise.ai/threats/cve-2026-61811-wazuh-is-an-open-source-security-platform-providing-unified-xdr)
- [Wazuh cluster key disclosure in GET /cluster/local/config](https://junglewise.ai/threats/cve-2026-61802-wazuh-cluster-key-disclosure-in-get-cluster-local-config)
- [Wazuh arbitrary file write in cluster worker file sync](https://junglewise.ai/threats/cve-2026-61800-wazuh-arbitrary-file-write-in-cluster-worker-file-sync)