CVE-2026-45798: Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-authd (TCP/1515) via crafted enrollment V: field
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, comparewazuhversions() in src/shared/versionop.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing a remote denial of service. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.6 - Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 5.0.0-beta2
Event History
Frequently Asked Questions
Which deployments are exposed?
Wazuh deployments running versions from 4.5.0 through 4.14.6, or 5.0.0-beta2, are affected when wazuh-authd is reachable on TCP port 1515 and anonymous TLS enrollment is enabled.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker needs network access to wazuh-authd on TCP/1515 and must send a crafted enrollment V: field containing at least nine non-null bytes. No credentials or user interaction are required.
What is the practical impact?
A crafted enrollment version field can cause out-of-bounds reads and modify adjacent stack memory through strtok(), resulting in a remote denial of service.
How can the risk be reduced before updating?
If an immediate update is not possible, disable anonymous TLS enrollment and restrict network access to wazuh-authd on TCP port 1515 to trusted enrollment sources.