CVE-2026-44254: Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, oszlibuncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.14.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
What access does an attacker need to trigger the issue?
An attacker needs low-privileged access sufficient to send an encrypted agent message to the remoted service on TCP port 1514. Exploitation also requires crafting a message that decompresses to 65,536 bytes.
What is the operational impact?
The out-of-bounds null-byte write occurs in the root-level remoted daemon and can crash message processing. This can disrupt communications between Wazuh and its agents.
Which versions should be remediated?
Versions from 1.0.0 through 4.14.6, and 5.0.0-beta2, are identified as affected. Update to a version containing the fix referenced for 4.14.6 or 5.0.0-beta2.