The vulnerability is a stack-based buffer overflow in the Security Configuration Assessment JSON parser in Wazuh. The flaw occurs when the decoder uses an unbounded sprintf with a %lf format to store a floating-point number in a fixed 128‑byte buffer. A specially crafted JSON event that contains a large exponent floating‑point value can cause the buffer to be overrun, resulting in stack corruption. Depending on how the overflow is leveraged, an attacker could cause a denial of service by crashing the Wazuh manager or potentially execute arbitrary code on the manager host. This weakness is mapped to CWE‑121 (stack‑based buffer overflow) and CWE‑787 (buffer access with incorrect length).

Affected systems are Wazuh installations using the wazuh package. The flaw exists from version 3.9.0 up to, but not including, 4.14.3. Versions 4.14.3 and later have been patched to eliminate the use of the unsafe sprintf call. Therefore any Wazuh manager running a version in the 3.9.0–4.14.2 range is vulnerable.

The CVSS score for this issue is 4.9, which falls into the moderate severity range. The EPSS score is less than 1%, indicating that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote; an attacker only needs to send the crafted JSON event to the wazuh-analysisd daemon. Since the decoder runs in the privileged manager process, successful exploitation could lead to a denial of service or higher privilege execution depending on how the stack corruption is used. Prompt patching mitigates the risk entirely.