CVE-2026-74045: Wazuh Buffer Overflow Vulnerability

CVE-2026-74045 Overview

CVE-2026-74045 is a heap buffer overflow in the Wazuh manager's wazuh-analysisd component. The flaw resides in the fim_generate_alert() function of the File Integrity Monitoring (FIM) decoder. The function sizes the full_log buffer from attacker-controlled input while writes are bounded by the larger OS_MAXSTR constant, enabling out-of-bounds heap writes. An enrolled Wazuh agent can send a crafted FIM syscheck event that corrupts manager heap memory and deterministically crashes wazuh-analysisd. The resulting process crash disables alert generation across the monitored fleet, producing a detection outage. The vulnerability affects Wazuh releases from 3.12.0 before 4.14.8 and is classified as [CWE-122] Heap-Based Buffer Overflow.

Critical Impact
A single compromised or malicious enrolled agent can disable fleet-wide threat detection by repeatedly crashing the Wazuh manager analysis daemon.

Affected Products

Wazuh 3.12.0 through 4.14.7 (manager component)
wazuh-analysisd FIM decoder
Fixed in Wazuh 4.14.8

Discovery Timeline

2026-10-13 - CVE-2026-74045 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-74045

Vulnerability Analysis

The defect lives in fim_generate_alert() inside the Wazuh manager's analysis daemon. This function builds an alert payload from decoded FIM syscheck events reported by agents. The allocation size for the full_log destination buffer is derived from fields in the incoming event, but subsequent write operations use the fixed OS_MAXSTR upper bound. When attacker-supplied input causes the allocation to be smaller than the amount actually written, the write overflows the heap chunk. Because the overflow is deterministic and attacker-controlled in length, repeated events reliably corrupt heap metadata and crash the daemon. When wazuh-analysisd terminates, the manager stops correlating events, generating alerts, and triggering active responses for every agent it serves.

Root Cause

The root cause is a size mismatch between buffer allocation and buffer writes. full_log is allocated based on input-derived length values, while the code path writes up to OS_MAXSTR bytes without re-validating that the destination can hold them. This violates the invariant that write bounds must never exceed allocation bounds and matches the [CWE-122] heap-based buffer overflow pattern.

Attack Vector

Exploitation requires an enrolled Wazuh agent, so the attacker needs valid agent credentials or control over an existing endpoint running the Wazuh agent. The attacker crafts a syscheck FIM event with field values that trigger the undersized allocation and oversized write when processed by the manager. The event is delivered over the normal agent-to-manager channel. No user interaction is required on the manager side, and the crash occurs each time the malicious event is processed, enabling a persistent denial-of-service condition against detection infrastructure. Technical analysis is published in the GitHub Security Advisory GHSA-gc4j-j9fg-4cfr and the VulnCheck Wazuh Advisory on Heap Overflow.

Detection Methods for CVE-2026-74045

Indicators of Compromise

Unexpected termination or repeated restarts of the wazuh-analysisd process on the Wazuh manager host.
Gaps in alert ingestion from one or more agents followed by a manager-wide alerting outage.
Core dumps or segmentation fault entries referencing wazuh-analysisd in /var/ossec/logs/ossec.log or system journal.
Agents sending malformed or unusually large syscheck FIM events shortly before manager crashes.

Detection Strategies

Monitor wazuh-analysisd process liveness and restart counts with a host-level availability check.
Alert on ossec.log entries containing Child process termination messages or analysisd crash signatures.
Baseline normal FIM event sizes per agent and flag outliers that exceed expected full_log field lengths.
Correlate agent enrollment events with subsequent manager instability to identify suspect endpoints.

Monitoring Recommendations

Forward Wazuh manager system logs and ossec.log to an external log store so evidence survives a daemon crash.
Track the volume and source agent of syscheck events to detect anomalous bursts targeting the FIM decoder.
Instrument alert pipeline latency and alert throughput as service-level indicators for detection availability.

How to Mitigate CVE-2026-74045

Immediate Actions Required

Upgrade all Wazuh manager nodes to version 4.14.8 or later as published in the GitHub Wazuh Release v4.14.8.
Audit enrolled agents and revoke keys for endpoints that are untrusted, decommissioned, or exhibiting anomalous behavior.
Enable automated restart of wazuh-analysisd via systemd to shorten detection outages while patching is in progress.
Verify log forwarding to an independent SIEM so a manager crash does not blind the security team.

Patch Information

Wazuh fixed the heap buffer overflow in fim_generate_alert() in release 4.14.8. The fix aligns the write bounds in the FIM decoder with the actual allocation size of the full_log buffer. Review the GitHub Security Advisory GHSA-gc4j-j9fg-4cfr for the full change set and upgrade guidance.

Workarounds

Restrict network access to the Wazuh manager agent ports to known agent subnets only.
Rotate agent enrollment keys and tighten enrollment policies to limit which hosts can register.
Temporarily disable FIM (syscheck) on untrusted agents by setting <disabled>yes</disabled> in the syscheck block until the manager is patched.

bash

# Configuration example: disable syscheck on an untrusted agent as a stopgap
# /var/ossec/etc/ossec.conf (agent)
<ossec_config>
  <syscheck>
    <disabled>yes</disabled>
  </syscheck>
</ossec_config>

# Then restart the agent
systemctl restart wazuh-agent