CVE-2026-112335: Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull
Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in readsnortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh Agent versions from 1.0.0 through versions before 4.14.9 are affected when the logcollector is monitoring a snort-full log. The described high-impact scenario is 32-bit Windows agents running as SYSTEM.
What access does an attacker need to exploit it?
An attacker must be able to write crafted multi-line content to a monitored snort-full log. The vulnerability is triggered when the agent's read_snortfull() log reader processes that content.
Is an agent affected by default?
The issue requires a snort-full log to be monitored by the logcollector, so exposure depends on that logging configuration. The provided information does not establish that this log reader is enabled by default.
What is the impact if exploitation succeeds?
Crafted log content can overflow a 65,280-byte stack buffer and crash the agent. On 32-bit Windows agents running as SYSTEM, the overflow may overwrite an SEH handler.
What should teams do if they cannot immediately update?
Restrict who can write to any monitored snort-full logs and prevent untrusted content from being written to them. Review whether snort-full log monitoring is necessary until the agent can be updated to 4.14.9 or later.