A size_t underflow in os_crypto shared msgs.c allows any enrolled Wazuh agent to send a crafted message that causes the wazuh-remoted daemon on the manager to crash, immediately disconnecting all connected agents. This denial of service results from the buffer overrun flaw identified as CWE-122 and the integer underflow classified as CWE-191. A second code path reached by the same underflow may lead to heap memory corruption, which could compromise the integrity of the manager process if successfully exploited, but the CVE does not confirm that such corruption results in arbitrary code execution.

The vulnerability affects the Wazuh platform, specifically versions 3.0.0 through 4.14.4. Wazuh is an open‑source threat prevention, detection, and response system used by many organizations for centralized log management and security monitoring.

The CVSS score is 6.5, indicating a moderate severity level. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an uninhibited agent sending a crafted message to the manager over, which is typically internal to the organization’s network. The impact is primarily a service outage, but the presence of a heap corruption path raises the potential risk for more damaging exploitation if an attacker can succeed in triggering the overflow.