A remote attacker can trigger a heap buffer overflow in the wazuh-analysisd process by sending rootcheck events whose key/value pairs exceed 30 bytes. The vulnerable W_JSON_ParseRootcheck function uses a fixed 30-byte buffer with a printf-style call, corrupting the heap and causing the analysis engine to crash. When the engine terminates, SIEM alert processing stops, while the dashboard and API continue to display stale data, effectively disabling the platform’s threat detection capabilities.

Wazuh manager installations from version 1.0.0 up through 4.14.4 are impacted. The flaw is present in the stock wazuh/wazuh-docker deployment, which ships with a default configuration that allows agents to enroll without authentication and communicates over the Wazuh agent protocol. The vulnerability was corrected in version 4.14.5.

The CVSS score of 7.5 indicates medium to high severity. With an EPSS score below 1% and no listing in the CISA KEV catalog, widespread exploitation is considered unlikely at present. Nevertheless, an unauthenticated remote attacker who can reach the agent protocol can easily trigger the crash, resulting in a denial of service that halts alert generation while the UI remains operational, potentially masking active threats.