CVE-2026-44254

{
  "id": "CVE-2026-44254",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T16:17:10.967",
  "lastModified": "2026-10-27T11:10:00.193",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."
    },
    {
      "lang": "es",
      "value": "Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Desde 1.0.0 hasta 4.14.6 y 5.0.0-beta2, HandleSecureMessage() en src/remoted/secure.c pasa un puntero dentro de su búfer de pila a ReadSecMSG(), y src/os_crypto/shared/msgs.c descomprime hasta OS_MAXSTR bytes en ese desplazamiento. Para un mensaje de agente cifrado en el puerto TCP 1514 que se expande a 65.536 bytes, os_zlib_uncompress() escribe un byte nulo de terminación más allá del final del búfer de destino. La escritura fuera de límites de la pila resultante en el demonio remoto de nivel raíz puede bloquear el procesamiento de mensajes e interrumpir las comunicaciones del agente. Este problema está solucionado en las versiones 4.14.6 y 5.0.0-beta2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wazuh",
          "product": "wazuh",
          "versions": [
            {
              "version": ">= 1.0.0, < 4.14.6",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0-beta1, < 5.0.0-beta2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T18:03:36.678329Z",
          "id": "CVE-2026-44254",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-131"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.0.0",
              "versionEndExcluding": "4.14.6",
              "matchCriteriaId": "48D41B6B-16D4-46DD-8349-7C4F82D78C2E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "007B01AA-AED0-4E92-8999-07E74B630460"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/pull/35773",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}