CVE-2026-44254
MediumCVSS 5.3Summary
In Wazuh from version 1.0.0 to 4.14.6 and 5.0.0-beta2, there is a stack out-of-bounds write vulnerability in HandleSecureMessage(). When processing an encrypted agent message on TCP port 1514, decompression can write a null byte beyond the end of the destination buffer, causing the remoted daemon to crash and disrupting agent communications.
Risk Assessment
An attacker can crash the remoted daemon, interrupting agent communications and potentially affecting security monitoring across the infrastructure.
Recommendation
Immediately upgrade Wazuh to version 4.14.6 or 5.0.0-beta2, where the vulnerability is fixed.
Original NVD description (English source)
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.