GHSA-f4pj-j296-jwp2: Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf

Published Nov 6, 2026

Updated

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wazuh to a version that resolves this vulnerability.
Fixed in 4.14.9

Event History

Nov 6, 2026

CVE Published

via OSV·03:00 PM

Data Sourced

via OSV·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Wazuh deployments are affected?

Wazuh versions from 1.0.0 through versions before 4.14.9 are affected. Version 4.14.9 is not included in the affected range.

What level of access does an attacker need?

The attacker must be able to control manager configuration, specifically ossec.conf active-response blocks. They can use that control to push more than 64 commands to agents.

What is the operational impact of exploitation?

Exploitation corrupts memory in a root process through wazuh-execd. It can crash Active Response across the fleet.

How can I assess whether an environment is exposed?

Check whether any Wazuh instance is running a version before 4.14.9 and whether privileged users or processes can modify manager active-response configuration. Exposure is relevant where those controls could result in more than 64 active-response commands being pushed to agents.

GHSA-f4pj-j296-jwp2: Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf

Remediation

Event History

Frequently Asked Questions

Which Wazuh deployments are affected?

What level of access does an attacker need?

What is the operational impact of exploitation?

How can I assess whether an environment is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which Wazuh deployments are affected?

What level of access does an attacker need?

What is the operational impact of exploitation?

How can I assess whether an environment is exposed?