The flaw is a stack-based buffer overflow triggered when wazuh-remoted formats attacker-controlled bytes using sprintf; the signed char promotion causes an 8-character string to be written into a 2-byte slot, corrupting the stack and potentially allowing arbitrary code execution or a crash. In addition, the same diagnostic path logs a full hex dump of the attacker-controlled data to /var/ossec/logs/ossec.log for each oversized message, enabling a remote log amplification that can consume disk space and I/O while degrading monitoring fidelity.

Wazuh versions from 4.8.0 up to but not including 4.14.4 are vulnerable. The affected binary is wazuh-remoted, which listens on TCP port 1514 for syslog messages. The fix was applied in release 4.14.4.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not recorded in the CISA KEV catalog. The stack overflow and log amplification are reachable remotely without authentication—an attacker only needs to send an oversized length‑prefixed message to port 1514, making the attack surface directly exposed to the network. While the description does not confirm exploitation beyond stack corruption, the potential for code execution or denial of service warrants serious concern for affected deployments.