Null Pointer Dereference in Wazuh wazuh-modulesd

Executive Summary

CVE-2026-56401 is a null pointer dereference vulnerability in the Wazuh wazuh-modulesd component before version 5.0.0-beta3. It occurs in the inventory_sync FlatBuffer DataValue handling when an enrolled agent sends a verifier-valid DataValue message that omits the optional id field. The wazuh-modulesd process attempts to dereference data->id()->string_view() without checking if data->id() is null, causing the process to crash.

This crash results in a denial of service condition for the manager-side Inventory Sync processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the wazuh-modulesd process on the Wazuh Manager to crash, leading to a denial of service (DoS). An enrolled agent can exploit this by sending a specially crafted DataValue message that omits the optional id field, triggering the crash.

The impact is primarily on availability, as the manager-side Inventory Sync processing becomes unavailable until the service is restarted or the issue is resolved.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes the wazuh-modulesd process to crash due to a null pointer dereference when handling a crafted DataValue message missing the optional id field.

Detection can involve monitoring for unexpected crashes or restarts of the wazuh-modulesd service, especially after receiving inventory_sync messages from enrolled agents.

Since the issue is triggered by a specific malformed DataValue message, network detection could focus on inspecting inventory_sync FlatBuffer messages for missing id fields, though no specific commands are provided in the available resources.

A practical approach is to check the version of wazuh-modulesd to confirm if it is before 5.0.0-beta3, which is vulnerable.

Example command to check the installed version of wazuh-modulesd:

• wazuh-modulesd -v

Additionally, monitoring system logs for crashes or segmentation faults related to wazuh-modulesd can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade wazuh-modulesd to version 5.0.0-beta3 or later, where the null pointer dereference vulnerability has been fixed.

If upgrading immediately is not possible, consider restricting or monitoring enrolled agents to prevent them from sending malformed DataValue messages that omit the id field.

Implement runtime validation or patch the code to check for null before dereferencing the id field in inventory_sync FlatBuffer handling, if you maintain a custom build.

Monitor wazuh-modulesd for crashes and restart the service as needed to maintain availability.

Useful 0 Not Useful 0