This vulnerability allows an attacker to corrupt the heap by writing a single byte before an allocated buffer in the parse_uname_string() function of Wazuh. The flaw exists in four locations within the function and occurs when an empty string is processed, causing an unsigned integer underflow that writes to the heap metadata. The resulting corruption can compromise the integrity of the process and potentially enable arbitrary code execution, reflecting CWE‑124 and CWE‑191 weaknesses.

The affected product is Wazuh, an open‑source security platform. Versions from 4.0.0 up to and including 4.14.3 are affected. The issue was fixed in Wazuh 4.14.4.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through data sent by an agent or the remote API that processes OS identification, though the description does not explicitly state the exact vector; this is inferred based on the function’s role in handling remote agent data. Exploitation would require an attacker to supply an empty string to parse_uname_string, which may be possible if an adversary can control agent communication. The risk of arbitrary code execution remains contingent on the attacker’s ability to inject such data and the presence of additional vulnerabilities that could be leveraged once heap corruption occurs.