CVE-2026-32984: Wazuh Buffer Overflow Vulnerability

CVE-2026-32984 Overview

CVE-2026-32984 is a heap-buffer overflow vulnerability in Wazuh's authentication daemon (authd) that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. This vulnerability enables attackers to trigger a denial of service condition, impacting the availability of the authentication daemon.

Critical Impact

Remote attackers can exploit this heap-buffer overflow to disrupt authentication services in Wazuh deployments, potentially affecting security monitoring capabilities during an active attack.

Affected Products

• Wazuh (all versions prior to patched release)
• Wazuh version 4.3.10
• Wazuh authd component

Discovery Timeline

• 2026-03-27 - CVE-2026-32984 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-32984

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), manifesting as a heap-buffer overflow in the Wazuh authd service. The authentication daemon fails to properly validate input boundaries when processing authentication requests, allowing attackers to read memory beyond the allocated buffer.

The vulnerability is remotely exploitable over the network without requiring authentication credentials. However, user interaction is required for successful exploitation. The impact is primarily limited to availability, as successful exploitation results in denial of service rather than data compromise or code execution.

Root Cause

The root cause stems from improper input validation in the authd component's request parsing logic. When processing specially crafted authentication requests, the daemon does not adequately verify buffer boundaries before reading heap memory, resulting in an out-of-bounds read condition that corrupts heap data structures.

Attack Vector

The vulnerability is exploitable via network-based attack vectors targeting the Wazuh authentication daemon. An attacker can send malformed input packets to the authd service, triggering the heap-buffer overflow condition.

The attack flow involves:

1. Identifying a target Wazuh deployment with an exposed authd service
2. Crafting malicious input that exceeds expected buffer boundaries
3. Sending the payload to trigger memory corruption
4. The service crashes or becomes unresponsive due to corrupted heap data

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory and VulnCheck Advisory.

Detection Methods for CVE-2026-32984

Indicators of Compromise

• Unexpected crashes or restarts of the wazuh-authd service
• Malformed or unusually large authentication requests in network traffic
• Core dumps or segmentation faults logged for the authd process
• Repeated connection attempts from suspicious IP addresses targeting authd ports

Detection Strategies

• Monitor Wazuh authd service for unexpected terminations or restart patterns
• Implement network intrusion detection rules to identify malformed authentication payloads
• Configure crash monitoring and alerting for the wazuh-authd process
• Review system logs for segmentation fault entries related to authd

Monitoring Recommendations

• Enable verbose logging for the Wazuh authentication daemon
• Deploy network traffic analysis to detect anomalous authentication requests
• Set up automated alerting for authd service availability disruptions
• Monitor heap memory usage patterns for the authd process

How to Mitigate CVE-2026-32984

Immediate Actions Required

• Review Wazuh deployment for exposure of authd services to untrusted networks
• Implement network segmentation to restrict access to the authentication daemon
• Apply vendor-provided patches as soon as available
• Consider temporarily disabling external access to authd if not required

Patch Information

Consult the official Wazuh security advisories for patching guidance. Additional information is available through the GitHub Security Advisory and VulnCheck Advisory.

Workarounds

• Restrict network access to the authd service using firewall rules
• Implement rate limiting on connections to the authentication daemon
• Deploy a reverse proxy or WAF to filter malformed requests before reaching authd
• Monitor and automatically restart the authd service if crashes are detected

# Example: Restrict authd access using iptables
# Allow only trusted management networks
iptables -A INPUT -p tcp --dport 1515 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1515 -j DROP