CVE-2026-44254 wazuh CVE debrief

Who should care

Defenders responsible for Wazuh installations, particularly those using versions from 1.0.0 to 4.14.6 and 5.0.0-beta2, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

Defenders should prioritize patching or mitigating CVE-2026-44254 to prevent potential disruptions to agent communications and crashes of message processing in the root-level remoted daemon. This vulnerability affects Wazuh versions from 1.0.0 to 4.14.6 and 5.0.0-beta2, and is triggered by an encrypted agent message on TCP port 1514.

• Potential disruption to agent communications
• Crash of message processing in the root-level remoted daemon

Technical summary

The HandleSecureMessage() function in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), which decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. This can cause a stack out-of-bounds write vulnerability in the root-level remoted daemon, potentially disrupting agent communications and causing crashes of message processing.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential disruptions to agent communications.

Recommended defensive actions

• Patch Wazuh to version 4.14.6 or 5.0.0-beta2
• Restrict access to TCP port 1514
• Monitor agent communications for disruptions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the HandleSecureMessage() function in src/remoted/secure.c passing a pointer inside its stack buffer to ReadSecMSG(), which decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.