Description

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-11-06T15:17:07.553Z",
  "pubdate": "2026-11-06T15:17:07.553Z",
  "executiveSummary": "Wazuh versions 1.0.0 through 4.14.8 are susceptible to an out-of-bounds write vulnerability within the wazuh-execd component.\nThis vulnerability stems from improper bounds checking when processing active-response configurations, allowing an attacker with privileged access to the manager's configuration to trigger a memory corruption event.\nBy manipulating the ar.conf file or specific active-response blocks within ossec.conf, an authenticated attacker can overflow internal memory buffers during the execution of the ReadExecConfig() function.\nSuccessful exploitation results in the corruption of root process memory, which can lead to application crashes, potential arbitrary code execution, or a wide-scale denial-of-service condition affecting the entire Active Response fleet managed by the Wazuh server.\nThe risk is categorized as high due to the potential for service disruption and the integrity compromise of the manager process.\nExploitation requires administrative-level access to modify the agent configuration, limiting the attack surface to malicious insiders or attackers who have already achieved elevated privileges on the manager node.",
  "technicalDetails": "The vulnerability resides in the wazuh-execd daemon, specifically within the logic responsible for parsing the active-response configuration. The ReadExecConfig() function is designed to ingest configuration parameters from ar.conf and ossec.conf into fixed-size internal arrays. The implementation fails to enforce strict boundary validation on the number of active-response command entries processed by the application.\nThe root cause is a static buffer allocation strategy that assumes a maximum threshold of 64 commands. When an attacker provides a configuration payload containing more than 64 entries, the ReadExecConfig() function continues to write data beyond the allocated bounds of the array. Because wazuh-execd operates with root privileges, these out-of-bounds writes directly affect sensitive areas of the heap or stack memory managed by the root process.\nThe attack flow initiates when a privileged attacker modifies the active-response configuration blocks. By injecting an excessive number of entries—exceeding the hard-coded 64-command limit—the attacker forces the application to perform an out-of-bounds write operation during the configuration loading phase. As the memory structure is corrupted, the application encounters an invalid state, leading to a segmentation fault or an unstable execution path.\nThe impact of this corruption is significant, as it occurs within the core Active Response process. Because the Active Response feature is a fleet-wide mechanism, the crash of the manager process propagates failure across the environment. If the memory corruption is leveraged by a sophisticated attacker, the overwrite could potentially be crafted to overwrite function pointers or return addresses, facilitating arbitrary code execution under the context of the root user.\nAffected versions include all Wazuh releases from 1.0.0 up to 4.14.9. The vulnerability is triggered during the routine parsing of the manager's configuration, which occurs on startup or upon signal-based configuration reloads. Since the attack requires the ability to modify system-level configuration files, the prerequisite for this vulnerability is elevated privileges on the host where the Wazuh manager is deployed.\nNetwork exposure is considered low as the vulnerability is triggered via local configuration files rather than direct remote input, though attackers gaining foothold via other RCE vulnerabilities could use this to escalate or sabotage the monitoring infrastructure."
}