CVE-2026-74045
Received Received - Intake

Heap Buffer Overflow in Wazuh Agent FIM Event Handling

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-74045
EUVD
EUVD-2026-98679

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wazuh wazuh-manager 3.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap buffer overflow in Wazuh's wazuh-analysisd component, specifically in the fim_generate_alert() function. An enrolled agent can send a crafted FIM syscheck event that causes the manager to write past the end of a heap allocation. This leads to memory corruption and a crash of the analysis engine, causing a fleet-wide detection outage.

Detection Guidance

Monitor wazuh-analysisd crashes or unexpected terminations on the Wazuh manager. Check for heap corruption errors in system logs or Wazuh logs. Use network traffic analysis to detect malformed FIM syscheck events from enrolled agents.

Impact Analysis

An attacker with a valid agent key can remotely crash the wazuh-analysisd process, stopping alert generation for the entire deployment. This results in a loss of detection capabilities across all agents, causing a fleet-wide outage without needing additional privileges or user interaction.

Mitigation Strategies

Upgrade Wazuh manager to version 4.14.8 or later immediately. Disable FIM syscheck events temporarily if an upgrade is not possible. Restrict agent enrollment to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart