CVE-2026-34150

Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing

Published Jul 16, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing {key: value} patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.

Analysis

Technical impact

A remote attacker can trigger a heap buffer overflow in the wazuh-analysisd process by sending rootcheck events whose key/value pairs exceed 30 bytes. The vulnerable W_JSON_ParseRootcheck function uses a fixed 30-byte buffer with a printf-style call, corrupting the heap and causing the analysis engine to crash. When the engine terminates, SIEM alert processing stops, while the dashboard and API continue to display stale data, effectively disabling the platform’s threat detection capabilities.

Affected Systems

Wazuh manager installations from version 1.0.0 up through 4.14.4 are impacted. The flaw is present in the stock wazuh/wazuh-docker deployment, which ships with a default configuration that allows agents to enroll without authentication and communicates over the Wazuh agent protocol. The vulnerability was corrected in version 4.14.5.

Risk and Exploitability

The CVSS score of 7.5 indicates medium to high severity. With an EPSS score below 1% and no listing in the CISA KEV catalog, widespread exploitation is considered unlikely at present. Nevertheless, an unauthenticated remote attacker who can reach the agent protocol can easily trigger the crash, resulting in a denial of service that halts alert generation while the UI remains operational, potentially masking active threats.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wazuh

affected

Version	Status	Constraints
`>= 1.0.0, < 4.14.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Wazuh

Version	Status	Scheme	Platform
`[1.0.0,4.14.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Wazuh manager to version 4.14.5 or later, which contains the buffer overflow fix.
If an upgrade is not immediately possible, disable or restrict the ingestion of rootcheck events that contain keys or values longer than 30 bytes by adjusting the rootcheck configuration.
Ensure that agent enrollment requires authentication—replace the default open enrollment with a password or certificate based mechanism.
Monitor system logs for repeated crashes or anomalous event patterns to confirm that the analysis engine remains operational.

Generated by OpenCVE AI on July 31, 2026 at 01:05 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.369% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883

History

Jul 17, 2026 11:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 17, 2026 3:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wazuh Wazuh wazuh
Vendors & Products		Wazuh Wazuh wazuh

Jul 17, 2026 12:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing {key: value} patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.
Title		Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing
Weaknesses		CWE-122
References		https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`