CVE-2026-34150 Overview
CVE-2026-34150 is a heap buffer overflow [CWE-122] in Wazuh's wazuh-analysisd component. The flaw affects Wazuh versions 1.0.0 through releases prior to 4.14.5. An unauthenticated remote attacker can crash the Wazuh manager's analysis engine, halting all Security Information and Event Management (SIEM) alert processing. The vulnerability is triggered through the default configuration shipped in the official wazuh/wazuh-docker deployment.
Critical Impact
A network-based attacker with no prior authentication can silently stop SIEM alert processing while the Wazuh dashboard and API continue displaying stale data, blinding defenders to in-progress attacks.
Affected Products
- Wazuh versions 1.0.0 through 4.14.4
- Wazuh manager component wazuh-analysisd
- Official wazuh/wazuh-docker deployment using default configuration
Discovery Timeline
- 2026-07-17 - CVE-2026-34150 published to the National Vulnerability Database (NVD)
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-34150
Vulnerability Analysis
The vulnerability resides in the W_JSON_ParseRootcheck function within wazuh-analysisd. The function uses sprintf to write into a fixed 30-byte stack-adjacent buffer without validating the length of incoming {key: value} pairs from rootcheck events. When an attacker supplies a key-value pattern longer than 30 bytes, the write overflows the buffer and corrupts adjacent heap memory. The corruption crashes wazuh-analysisd, terminating the analysis pipeline that correlates and alerts on incoming agent events.
Crucially, the crash is silent from an operator's perspective. The Wazuh dashboard and API continue to serve cached and stale data, so alert processing appears healthy while no new events are being evaluated.
Root Cause
The root cause is missing input length validation in W_JSON_ParseRootcheck. The function assumes rootcheck event fields fit within a 30-byte buffer and calls sprintf, an unbounded string formatter. Attacker-controlled data flows directly from the network protocol into the vulnerable format operation, producing a heap buffer overflow classified as [CWE-122].
Attack Vector
Exploitation follows the standard Wazuh agent onboarding path. The attacker connects to authd on the Wazuh manager, which, in the default Docker configuration, accepts enrollment without a password. Enrollment returns a valid agent ID and encryption key. The attacker then connects to remoted over the Wazuh agent protocol and submits a crafted rootcheck event containing a {key: value} pattern exceeding 30 bytes. The malformed event reaches W_JSON_ParseRootcheck, triggers the overflow, and crashes the analysis engine. See the Wazuh GitHub Security Advisory for full technical details.
Detection Methods for CVE-2026-34150
Indicators of Compromise
- Unexpected termination or repeated restarts of the wazuh-analysisd process on the manager host
- New agent enrollments from unknown IP addresses to authd with no matching operational rollout
- Rootcheck events containing abnormally long {key: value} strings arriving at remoted
- Divergence between the volume of events ingested by remoted and alerts generated downstream
Detection Strategies
- Monitor process health and exit codes for wazuh-analysisd and alert on any non-graceful termination
- Inspect ossec.log and manager logs for parser errors or crash traces near W_JSON_ParseRootcheck
- Correlate agent enrollment events against an approved asset inventory to flag unauthorized IDs
Monitoring Recommendations
- Track the rate of alerts produced by the manager and alarm on sudden drops to near-zero
- Baseline the expected size distribution of rootcheck event fields and flag outliers above 30 bytes
- Instrument watchdog checks that verify end-to-end alert delivery rather than relying solely on dashboard status
How to Mitigate CVE-2026-34150
Immediate Actions Required
- Upgrade the Wazuh manager to version 4.14.5 or later on all deployments, including containerized installs
- Disable password-less agent enrollment on authd and require a shared password or certificate-based enrollment
- Restrict network access to authd (default TCP 1515) and remoted (default TCP/UDP 1514) to trusted agent subnets only
Patch Information
Wazuh has fixed the heap buffer overflow in version 4.14.5. Operators running any release from 1.0.0 through 4.14.4 must upgrade to 4.14.5 or newer. The fix is described in the Wazuh Security Advisory GHSA-rvr9-89q8-w883.
Workarounds
- Enforce authenticated enrollment by setting a password in authd and removing the default password-less mode used by wazuh/wazuh-docker
- Place the Wazuh manager behind a firewall or VPN so only vetted agent hosts can reach authd and remoted
- Deploy network detection rules that drop rootcheck payloads exceeding expected field lengths until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
