CVE-2026-44254: Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-19 · updated 2026-10-27
Weakness: CWE-131

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Affected products

wazuh: from 1.0.0 before 4.14.6; 5.0.0-beta1 — fixed in 4.14.6

How to fix

Upgrade to a fixed version: wazuh 4.14.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-44254 or the next vulnerability affects your stack