Wazuh authd contains a heap‑buffer overflow that occurs when it processes specially crafted input, leading to corruption of heap memory and malformed heap data. The result is a crash or unresponsiveness of the authentication daemon, which manifests as a denial of service that interrupts authentication services. This weakness is classified as CWE‑125.

The vulnerability affects the wazuh-authd service in the Wazuh security platform. All versions that include the unpatched code are vulnerable until a fix is released. Users of the Wazuh platform hosting the authentication daemon should verify whether their deployment runs the affected code base and check for a patched release.

The CVSS score of 5.3 classifies the issue as moderate severity; EPSS data is not available, and it is not listed in the CISA KEV catalog, so the likelihood of exploitation remains uncertain. The likely attack vector is remote attackers sending malicious payloads through the authentication interface, which can trigger memory corruption and force the daemon to crash, reducing availability. Because the vulnerability does not appear to require local or privileged access, it potentially affects any system reachable over the network to the authentication service.