PatchSiren cyber security CVE debrief

CVE-2026-34150 wazuh CVE debrief

A heap buffer overflow vulnerability exists in Wazuh's wazuh-analysisd component, which allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing a complete loss of SIEM alert processing. The vulnerability is exploitable via the default configuration shipped in the official wazuh/wazuh-docker deployment. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing {key: value} patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd.

Vendor: wazuh
Product: Unknown
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-17
Original CVE updated: 2026-07-17
Advisory published: 2026-07-17
Advisory updated: 2026-07-17

Who should care

Security teams and administrators responsible for Wazuh deployments should be aware of this vulnerability and take immediate action to mitigate the risk. This vulnerability can be exploited by an unauthenticated remote attacker, which makes it a high-severity issue.

Technical summary

The vulnerability exists in the wazuh-analysisd component of Wazuh, which is a free and open-source platform used for threat prevention, detection, and response. The vulnerability is caused by a heap buffer overflow in the W_JSON_ParseRootcheck function, which can be triggered by injecting rootcheck events containing {key: value} patterns longer than 30 bytes. This can be done by an unauthenticated remote attacker who has enrolled with authd without a password to obtain a valid agent ID and encryption key.

Defensive priority

High

Recommended defensive actions

Update Wazuh to version 4.14.5 or later
Implement network restrictions to limit access to the Wazuh manager's analysis engine
Monitor Wazuh logs for suspicious activity
Consider implementing additional security controls, such as authentication and authorization for authd
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-17T00:16:25.520Z and has not been modified since then. The NVD entry is currently in the 'Received' status. The vulnerability has a CVSS score of 7.5 and a severity of HIGH.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-17T00:16:25.520Z and has not been modified since then. The NVD entry is currently in the 'Received' status.