CVE-2023-7340

Wazuh authd service (os_auth) Heap-based Buffer Overflow

Published Mar 27, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low availability impact to the authentication daemon.

Analysis

Technical impact

Wazuh authd contains a heap-buffer overflow that allows attackers to corrupt memory and produce malformed heap data. This vulnerability gives adversaries the ability to trigger a denial-of-service condition, terminating the authentication daemon and causing a temporary loss of availability.

Affected Systems

The affected product is Wazuh, a security monitoring and IDS platform. The vulnerability exists in the authentication daemon (authd) of Wazuh versions 4.3.10 and earlier, as indicated by the associated CPE entries. Administrators should confirm whether their deployment uses those affected releases.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send specially crafted input to the authd service, likely over the network interface that agents use to authenticate. Given that the issue leads only to service crashes and not privilege escalation, the overall risk is limited to short‑lived denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Wazuh

unaffected

Version	Status	Constraints
`3.5.0`	affected	≤ 4.3.10

Configuration 1 [-]

OR	cpe:2.3:a:wazuh:wazuh::::::::
	cpe:2.3:a:wazuh:wazuh:4.3.10:::::::*

No data.

Vendor Product Versions

Wazuh

Version	Status	Scheme	Platform
`3.5.0`	affected	semver	['linux']
`4.3.10`	affected	semver	['linux']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Wazuh to the latest release that resolves CVE‑2023‑7340 (for example, version 4.3.11 or later).
If an upgrade is temporarily infeasible, restrict network access to the authd service by firewalling or disabling unused agent‑connection interfaces until the patch is applied.
Monitor authd logs for abrupt process restarts or out‑of‑memory kills that could indicate exploitation attempts.
Validate service stability after any changes by testing authentication flows to ensure no denial of service incidents occur.

Generated by OpenCVE AI on March 31, 2026 at 19:28 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.336% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/wazuh/wazuh/security/advisories/GHSA-grjq-p5fg-m24r
https://www.vulncheck.com/advisories/heap-buffer-overflow-in-wazuh-authd

History

May 12, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}`	cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}`

Mar 31, 2026 6:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:wazuh:wazuh:::::::: cpe:2.3:a:wazuh:wazuh:4.3.10:::::::*

Mar 30, 2026 7:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wazuh Wazuh wazuh
Vendors & Products		Wazuh Wazuh wazuh

Mar 27, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 27, 2026 8:00 PM Title updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Heap buffer overflow in wazuh-authd	Wazuh authd service (os_auth) Heap-based Buffer Overflow
Metrics	cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}`	cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}`

Mar 27, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low availability impact to the authentication daemon.
Title		Heap buffer overflow in wazuh-authd
Weaknesses		CWE-125
References		https://github.com/wazuh/wazuh/security/advisories/GHSA-grjq-p5fg-m24r https://www.vulncheck.com/advisories/heap-buffer-overflow-in-wazuh-authd
Metrics		cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`