CVE-2026-45798
Received Received - Intake

Stack Buffer Overflow in Wazuh Agent

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing a remote denial of service. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-45798
EUVD
EUVD-2026-62574

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wazuh wazuh 4.5.0
wazuh wazuh 4.14.6
wazuh wazuh 5.0.0-beta2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-170 The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication stack-based buffer overflow in Wazuh's enrollment process. The flaw exists in the compare_wazuh_versions() function which copies an attacker-controlled version string into a small stack buffer without proper null termination. When the version string is exactly 9 bytes, strncpy fails to add a null terminator, causing subsequent string operations to read and write beyond the buffer. This leads to a remote denial of service by crashing the wazuh-authd service on TCP port 1515.

The vulnerability is triggered through the V: field in an enrollment message sent to the unauthenticated wazuh-authd service using anonymous TLS. A crafted 38-byte message can reliably crash the daemon.

Detection Guidance

Check if Wazuh manager versions 4.5.0 to 4.14.5 or 5.0.0-beta2 are running. Inspect network traffic on TCP port 1515 for malformed enrollment messages containing a V: field with a version string of at least nine non-null bytes. Use Wazuh logs to identify crashes in wazuh-authd during enrollment.

Impact Analysis

This vulnerability allows remote attackers to crash the Wazuh manager's authentication daemon (wazuh-authd) without authentication. This causes a denial of service, stopping the Wazuh service from processing legitimate requests. The attack requires network access to TCP port 1515 but no user interaction or privileges.

Compliance Impact

This vulnerability is a pre-authentication stack-based buffer overflow in Wazuh's enrollment process that can cause a denial of service by crashing the wazuh-authd service. While it does not directly expose or leak data, a DoS condition could disrupt monitoring and logging capabilities, potentially impacting compliance with standards like GDPR or HIPAA that require continuous data protection and availability.

Mitigation Strategies

Upgrade Wazuh manager to version 4.14.6 or later. Disable anonymous TLS enrollment if not required by setting authd.enrollment.anonymous_no_pass=true to false in wazuh-authd configuration. Block external access to TCP port 1515 at the firewall level if enrollment is not needed remotely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart