The vulnerability occurs when the remoted daemon processes an encrypted agent message on TCP port 1514, causing the decompress function to write a null byte beyond the end of the destination buffer and corrupting the stack. This stack overflow can crash the daemon, leading to loss of service for any connected agents and disrupting threat prevention and detection functions. The flaw is a classic buffer over‑size problem (CWE‑131/787) and does not provide direct code execution, but it can be used to deny service to any monitored host.

Wazuh’s remoted component is affected in all releases from the initial 1.0.0 up to, but not including, version 4.14.6 and version 5.0.0‑beta2. The fix is applied in releases 4.14.6 and later, as well as 5.0.0‑beta2 and later. Administrators using older agent versions or earlier distributions must verify the daemon version and apply updates accordingly.

With a CVSS score of 5.3 the risk is moderate; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the agent’s listening port 1514 can craft a malicious encrypted payload that triggers the out‑of‑bounds write, causing the daemon to crash. The exploit requires network access and knowledge of the encryption protocol, implying a remote attack vector but not privileged system access.