CVE-2026-44251: Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-17 · updated 2026-07-20
Weakness: CWE-122

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents from the manager. A second code path reached by the same underflow may allow heap memory corruption. This issue has been fixed in version 4.14.5.

Affected products

wazuh: from 3.0.0 before 4.14.5 — fixed in 4.14.5

How to fix

Upgrade to a fixed version: wazuh 4.14.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-44251 or the next vulnerability affects your stack