An integer underflow occurs in the Wazuh Database synchronization module (wdb_delta_event.c) when constructing an SQL query using snprintf. The code incorrectly aggregates the return value, allowing the remaining buffer size calculation to wrap around to a very large integer if the payload exceeds 2048 bytes. This removes bounds checking for subsequent writes, corrupting the stack. The overflow can cause a Denial of Service or, in the worst case, Remote Code Execution. The vulnerability maps to CWE-121 (Stack-Based Buffer Overflow) and CWE-191 (Integer Underrun).

Vendors: Wazuh. Product: wazuh. Affected versions: all releases starting with 4.4.0 up through 4.14.2. Version 4.14.3 contains the fix. The issue exists in the database synchronization component that handles external sync payloads.

The CVSS score of 4.9 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires an attacker to supply an oversized synchronization payload, which could be delivered remotely if the sync interface is exposed or locally if the attacker has access to the database replication process. Based on the description, the likely attack vector is remote API or inter-node communication, but explicit vector data is not provided.