CVE-2026-112334: Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.9
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileged control of manager configuration, specifically the ability to control active-response blocks in ossec.conf. The issue is not described as exploitable by an unprivileged agent or unauthenticated network attacker.
What systems are affected?
Wazuh versions from 1.0.0 through versions before 4.14.9 are affected. The vulnerable component is wazuh-execd, and the impact applies to agents that receive the excessive active-response command configuration.
What configuration triggers the vulnerability?
The condition is triggered when more than 64 active-response commands are pushed to agents through ar.conf. This overflows arrays used by ReadExecConfig(), allowing corruption of memory in a root process and potentially crashing Active Response across the fleet.
What should be done if updating is not immediately possible?
Restrict privileged access to manager configuration and prevent untrusted parties from modifying ossec.conf active-response blocks. Keep active-response command entries at 64 or fewer until the affected systems can be updated to 4.14.9 or later.