Wazuh authd contains a heap-buffer overflow that allows attackers to corrupt memory and produce malformed heap data. This vulnerability gives adversaries the ability to trigger a denial-of-service condition, terminating the authentication daemon and causing a temporary loss of availability.

The affected product is Wazuh, a security monitoring and IDS platform. The vulnerability exists in the authentication daemon (authd) of Wazuh versions 4.3.10 and earlier, as indicated by the associated CPE entries. Administrators should confirm whether their deployment uses those affected releases.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send specially crafted input to the authd service, likely over the network interface that agents use to authenticate. Given that the issue leads only to service crashes and not privilege escalation, the overall risk is limited to short‑lived denial of service.