CVE-2026-41499: Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-29 · updated 2026-06-17
Weakness: CWE-124

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.

Affected products

wazuh: from 4.0.0 before 4.14.4 — fixed in 4.14.4

How to fix

Upgrade to a fixed version: wazuh 4.14.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41499 or the next vulnerability affects your stack