CVE-2026-74045: Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fimgeneratealert() where fulllog is sized from input but written bounded by OSMAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Wazuh deployments running versions from 3.12.0 before 4.14.8 are affected. The vulnerable component is wazuh-analysisd on the manager, and impact can disrupt detection across the fleet.
What access does an attacker need to trigger the crash?
An attacker needs an enrolled Wazuh agent capable of sending a crafted FIM syscheck event to the manager. No user interaction is required.
What is the operational impact of successful exploitation?
A crafted event can corrupt heap memory in wazuh-analysisd and deterministically crash the process. This causes a fleet-wide detection outage.
What version resolves the issue?
Upgrade Wazuh to version 4.14.8 or later. The affected range ends before 4.14.8.