Wazuh versions 1.0.0 through 4.14.8 contain an out‑of‑bounds write in the wazuh‑execd executable. The flaw is triggered when active‑response configuration files – specifically ar.conf – include more than 64 command entries. An attacker with privileged manager‑configuration access can construct an excessive ar.conf that overflows ReadExecConfig() arrays, corrupting root process memory. This memory corruption can lead to arbitrary code execution or a crash that brings down the Active Response engine across all agents, effectively denying service to the entire fleet.

The vulnerability affects the Wazuh Wazuh security information and event management platform. Any deployment running Wazuh version 1.0.0 through 4.14.8, including the release series from 1.0.0 to 4.14.8, is impacted.

The CVSS base score is 6.9, indicating a medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires privileged manager‑configuration access, which is typically limited to internal operators. The attacker would craft an ar.conf file with more than 64 commands and trigger it via the ossec.conf active‑response blocks, causing wazuh‑execd to write beyond its buffer. Because the bug corrupts memory in the root process, there is potential for local privilege escalation to root or for a denial‑of‑service that cannot be recovered without restarting the Wazuh service.