CVE-2024-32038: Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-19 · updated 2026-06-17
Weakness: CWE-122

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2.

Affected products

wazuh: from 3.8.0 before 4.7.2 — fixed in 4.7.2

How to fix

Upgrade to a fixed version: wazuh 4.7.2. Check the vendor advisory for mitigations.

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327
https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327

Get alerted when CVE-2024-32038 or the next vulnerability affects your stack