Description
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
Published: 2026-10-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (fleet-wide detection outage)
Action: Patch
AI Analysis

Impact

The vulnerability is a heap buffer overflow in the function that generates file integrity monitoring alerts. A crafted FIM event can cause the heap to be corrupted, which leads to a deterministic crash of wazuh-analysisd. The crash disables the central analysis service and results in a fleet-wide loss of detection capability. This flaw is classified as CWE-122.

Affected Systems

The flaw affects the Wazuh Manager component of the Wazuh platform, specifically versions 3.12.0 up to and including 4.14.7. The fix is released in version 4.14.8.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is considered high impact. The EPSS score is unavailable, and it is not listed in CISA KEV. Attackers must be able to send FIM syscheck events, so the threat is most relevant to internal users or rogue agents on the network. The outcome is a service disruption that can be avoided by patching.

Generated by OpenCVE AI on October 13, 2026 at 15:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the wazuh-manager component to version 4.14.8 or later.
  • Verify that only trusted agents are enrolled and consider restricting or disabling FIM syscheck events for untrusted nodes.
  • After applying the patch, restart wazuh-analysisd or the entire Wazuh service to clear any corrupted heap memory.

Generated by OpenCVE AI on October 13, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
Title Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
First Time appeared Wazuh
Wazuh wazuh
Weaknesses CWE-122
CPEs cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
Vendors & Products Wazuh
Wazuh wazuh
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Wazuh Wazuh
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T14:15:49.460Z

Reserved: 2026-08-14T14:06:40.513Z

Link: CVE-2026-74045

cve-icon Vulnrichment

Updated: 2026-10-13T13:47:55.655Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T14:17:41.160

Modified: 2026-10-15T15:49:21.457

Link: CVE-2026-74045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T01:45:17Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow