The vulnerability originates from an unsafe copy of the enrollment V field into a fixed 10‑byte buffer within compare_wazuh_versions(). The code uses strncpy() without ensuring null‑termination, which allows a specially crafted string of at least nine non‑null bytes to overflow the buffer. This overflow can trigger strchr() and strtok() to read beyond the intended boundary, and strtok() may write a null byte into adjacent stack memory, ultimately causing the wazuh‑authd process to crash. The crash results in a denial of service before user authentication is completed.

This flaw affects Wazuh releases from version 4.5.0 up to, but not including, 4.14.6, and also earlier 5.0.0-beta releases prior to 5.0.0-beta2. Version 4.14.6 and 5.0.0-beta2 contain the fix and are not vulnerable.

The CVSS score of 7.5 labels the issue as high risk, and the lack of an EPSS rating means the exploitation probability cannot be precisely quantified yet. The flaw is not listed in CISA's KEV catalog, suggesting it has not yet been actively exploited in the wild. Attackers would need to send a crafted enrollment V field to wazuh‑authd over TCP port 1515 while anonymous TLS enrollment is enabled, giving them remote denial of service without requiring authentication.