CVE-2026-44254: Wazuh Buffer Overflow Vulnerability

CVE-2026-44254 Overview

CVE-2026-44254 is a stack out-of-bounds write vulnerability in Wazuh, an open source platform for threat prevention, detection, and response. The flaw affects versions 1.0.0 through 4.14.6 and 5.0.0-beta2. The HandleSecureMessage() function in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), while src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. When an encrypted agent message received on TCP port 1514 expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the destination buffer. This corrupts the stack of the root-level remoted daemon and can disrupt agent communications.

Critical Impact
A low-privileged network attacker able to send crafted encrypted agent messages on TCP port 1514 can crash the root-level remoted daemon and disrupt Wazuh agent-to-manager communications.

Affected Products

Wazuh versions 1.0.0 through 4.14.5
Wazuh 5.0.0-beta1
Wazuh remoted daemon (src/remoted/secure.c, src/os_crypto/shared/msgs.c)

Discovery Timeline

2026-08-19 - CVE-2026-44254 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-44254

Vulnerability Analysis

The vulnerability is an incorrect calculation of buffer size [CWE-131] in the Wazuh manager's remoted daemon. The remoted process listens on TCP port 1514 and handles encrypted messages from Wazuh agents. When a message is marked as compressed (prefixed with !), the code invokes os_zlib_uncompress() to decompress the payload into a stack buffer.

The caller HandleSecureMessage() passes a pointer that already sits inside its stack buffer to ReadSecMSG(). The decompression routine then treats up to OS_MAXSTR (65,536) bytes as available at that offset. When decompressed content reaches the full 65,536-byte size, the routine writes a terminating null byte one position past the end of the destination buffer.

Root Cause

The root cause is a boundary miscalculation between two functions. ReadSecMSG() does not account for the offset already consumed inside the caller's stack buffer when computing the maximum decompression length. The trailing null terminator produced by os_zlib_uncompress() therefore lands outside the allocated stack region, corrupting adjacent stack data in a root-owned process.

Attack Vector

An attacker with valid agent credentials, or the ability to inject an encrypted message on TCP port 1514, sends a compressed payload crafted to expand to exactly 65,536 bytes after decompression. The out-of-bounds null byte write corrupts the remoted daemon's stack and terminates message processing. This disrupts agent telemetry ingestion across the Wazuh deployment.

// Security patch in src/os_crypto/shared/msgs.c
// Source: https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96

    /* Compressed */
    if (cleartext[0] == '!') {
+        static __thread char decompress_buffer[OS_MAXSTR + 1];
+
        cleartext[buffer_size] = '\0';
        cleartext++;
        buffer_size--;

The fix introduces a dedicated thread-local decompress_buffer of size OS_MAXSTR + 1, giving os_zlib_uncompress() a properly sized destination that accommodates the terminating null byte without overrunning the caller's stack buffer.

Detection Methods for CVE-2026-44254

Indicators of Compromise

Unexpected crashes or restarts of the wazuh-remoted process on the manager
Gaps in agent event ingestion coinciding with remoted daemon failures
Anomalously large or malformed encrypted agent messages arriving on TCP port 1514
remoted daemon core dumps with stack corruption signatures

Detection Strategies

Monitor process supervisor logs for repeated wazuh-remoted termination or restart events
Inspect Wazuh manager logs for decompression errors or abrupt disconnects from multiple agents
Compare installed Wazuh version against the fixed releases 4.14.6 and 5.0.0-beta2
Track inbound traffic volume and payload size distributions on TCP port 1514 for outliers

Monitoring Recommendations

Alert on any non-zero exit status from the remoted service manager unit
Correlate spikes in agent reconnection attempts with manager-side daemon crashes
Baseline expected compressed payload sizes from managed agents and flag deviations
Retain packet captures on port 1514 during triage to reconstruct malicious payloads

How to Mitigate CVE-2026-44254

Immediate Actions Required

Upgrade Wazuh managers to version 4.14.6 or 5.0.0-beta2, which contain the fix
Restrict TCP port 1514 to trusted agent networks using host or network firewalls
Rotate agent keys if unauthorized systems may have registered against the manager
Review remoted daemon uptime and crash logs to identify prior exploitation attempts

Patch Information

The vulnerability is fixed in Wazuh Release v4.14.6 and Wazuh Release v5.0.0-beta2. The corrective change is documented in the GitHub commit 96772487 and the GitHub Pull Request Discussion. See the GitHub Security Advisory GHSA-9wm4-fp6c-hqgq for the full vendor advisory.

Workarounds

Limit TCP port 1514 exposure to authenticated agent subnets via firewall ACLs
Enforce strict agent enrollment controls to prevent unauthorized key issuance
Monitor and automatically restart the wazuh-remoted service to reduce downtime while patching

bash

# Verify Wazuh manager version and upgrade to a fixed release
/var/ospatch/wazuh-control info
apt-get update && apt-get install --only-upgrade wazuh-manager=4.14.6-1

# Restrict TCP 1514 to trusted agent subnets (example using iptables)
iptables -A INPUT -p tcp --dport 1514 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1514 -j DROP