CVE-2026-44254 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh installations, particularly those using versions from 1.0.0 to 4.14.6 and 5.0.0-beta2, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

Defenders should prioritize patching or mitigating CVE-2026-44254 to prevent potential disruptions to agent communications and crashes of message processing in the remoted daemon. This vulnerability affects Wazuh versions from 1.0.0 to 4.14.6 and 5.0.0-beta2, and is triggered by a specially crafted encrypted agent message on TCP port 1514.

• Potential disruption to agent communications
• Crash of message processing in the remoted daemon

Technical summary

The HandleSecureMessage() function in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), which decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer, resulting in a stack out-of-bounds write. This issue affects Wazuh versions from 1.0.0 to 4.14.6 and 5.0.0-beta2, and can be triggered by a specially crafted encrypted agent message.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential disruptions to agent communications.

Recommended defensive actions

• Patch Wazuh to version 4.14.6 or 5.0.0-beta2
• Restrict access to TCP port 1514
• Monitor agent communications for disruptions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the HandleSecureMessage() function in src/remoted/secure.c passing a pointer inside its stack buffer to ReadSecMSG(), which decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer, resulting in a stack out-of-bounds write.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.