A heap-based out‑of‑bounds write allows the system to write a null byte one byte before the start of a buffer created by strdup in GetAlertData. This corrupts heap metadata and can lead to denial of service or arbitrary corruption when a malformed alert is injected into the alerts log file. The weakness is a buffer underflow that propagates to critical heap structures.

The flaw affects all Wazuh installations from version 1.0.0 up to, but not including, 4.14.4. Any system running these versions and accepting alerts from agents is vulnerable. Updated releases 4.14.4 and later include a patch that fixes the underflow.

The CVSS base score of 4.4 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in KEV, suggesting limited widespread exploitation. Attackers would need to compromise or control an agent to inject a crafted alert that triggers the write. Once the heap is corrupted, a server restart or process crash can occur, causing denial of service. The absence of remote code execution limits impact, but the loss of service can be significant for high‑availability deployments. Given the lack of public exploit evidence, the risk is considered moderate but still actionable.