Wazuh authd has a heap-buffer overflow that allows attackers to send specially crafted data, corrupting heap memory and creating malformed heap structures. When the corruption occurs, the daemon crashes, resulting in a denial of service condition. The identified impact is limited to a temporary loss of authentication service availability, with no evidence of data compromise or privilege escalation.

All editions of the Wazuh authentication daemon (wazuh-authd) may be affected. The vendor supplied no specific version range for the flaw, so users should assume that every release is potentially vulnerable until a patch is released. No additional affected products or vendors were listed.

The CVSS score of 5.3 indicates a medium severity. Exploitability data from EPSS is unavailable, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must be able to send crafted input to the authd service, implying a remote or local network‑level interaction. The resulting denial of service could interrupt authentication for legitimate users, temporarily crippling security monitoring and enforcement, but it does not directly expose data or compromise system integrity.