A heap-based buffer overflow occurs in the syscheck component of the Wazuh agent when expanding registry paths that contain wildcard characters. The agent allocates a fixed 256-byte heap buffer and then concatenates a subkey name that can be up to 255 characters long. The out-of-bounds write corrupts memory, leading to either a silent crash of the agent or, because the agent runs as NT AUTHORITY\\SYSTEM, a local privilege escalation to SYSTEM credentials.

The vulnerability affects Wazuh agent for Windows versions 4.6.0 through 4.14.4. Any system running these releases and actively scanning registry paths that include wildcard characters is susceptible if an attacker can create a sufficiently long subkey under a monitored path.

The CVSS score of 4.7 indicates moderate severity, while an EPSS score of less than 1 percent suggests low likelihood of exploitation in the wild. The bug is local and requires an attacker to have the ability to write a 255-character registry subkey under a monitored path. Successful exploitation can silently stop the agent or, because the agent runs as SYSTEM, elevate the attacker to full system privileges. The vulnerability is not listed in CISA KEV.