CVE-2026-44254
Received Received - Intake

Stack-Based Buffer Overflow in Wazuh Remoted Daemon

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-44254
EUVD
EUVD-2026-62554

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
wazuh wazuh From 1.0.0 (inc) to 4.14.6 (inc)
wazuh wazuh 1.0.0
wazuh wazuh 4.14.6
wazuh wazuh 5.0.0-beta2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44254 is a stack out-of-bounds write vulnerability in Wazuh's remoted daemon. It occurs when processing encrypted agent messages on TCP port 1514. The issue involves a pointer offset during decompression that causes a null terminator to be written beyond the stack buffer's end when decompressed data reaches 65,536 bytes. This can crash the daemon and disrupt agent communications.

Detection Guidance

This vulnerability requires specific conditions to trigger, such as an enrolled agent sending a malformed encrypted message. Detection involves monitoring for crashes in the Wazuh remoted daemon or unusual agent disconnections. Check logs for segmentation faults or buffer overflow errors in /var/ossec/logs/remoted.log. Use tools like AddressSanitizer during compilation to detect memory corruption.

Impact Analysis

This vulnerability can cause crashes in the Wazuh manager's remoted daemon, leading to denial of service and disrupting agent communications. It requires a valid enrolled agent with a known key to trigger but does not allow arbitrary code execution. The impact is limited to service disruption rather than data compromise.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service conditions that disrupt agent communications and message processing in the Wazuh platform. A crash in the root-level remoted daemon may lead to interrupted monitoring and logging, which are critical for maintaining compliance with data protection and security requirements.

Mitigation Strategies

Upgrade Wazuh to version 4.14.6 or later immediately. If upgrading is not possible, apply the patch from the GitHub pull request #35773. Restrict network access to TCP port 1514 to trusted agents only. Monitor for suspicious activity and ensure backups of critical Wazuh configurations are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart