Description

Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-11-06T15:17:07.730Z",
  "pubdate": "2026-11-06T15:17:07.730Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists within the Wazuh agent's logcollector module, specifically affecting the snort-full log reader. This flaw originates from an improper calculation of remaining buffer space during the execution of the read_snortfull() function.\nThe vulnerability allows an unauthenticated attacker to trigger a crash or achieve arbitrary code execution by supplying crafted, multi-line content to a monitored snort-full log file.\nAffected products include Wazuh agent versions ranging from 1.0.0 up to, but not including, 4.14.9. The impact is particularly severe on 32-bit Windows systems where the agent executes with SYSTEM-level privileges. Successful exploitation could allow an attacker to overwrite SEH (Structured Exception Handling) handlers, leading to potential remote code execution.\nThis vulnerability poses a significant security risk, as it permits local log-based exploitation to escalate privileges or compromise the integrity of the host monitored by the Wazuh agent. Organizations are advised to prioritize upgrading to version 4.14.9 or later to remediate the buffer overflow vulnerability.",
  "technicalDetails": "The vulnerability is located in the logcollector component of the Wazuh agent, specifically within the read_snortfull() function, which is responsible for parsing and processing logs generated by Snort in the snort-full format.\nThe root cause is a miscalculation of remaining buffer space during the processing of log entries. The function utilizes a fixed-size stack buffer of 65,280 bytes to store log data. When read_snortfull() encounters crafted multi-line input, the logic fails to correctly validate the size of the incoming data against the remaining capacity of the allocated buffer. This leads to an out-of-bounds write operation, effectively resulting in a classic stack-based buffer overflow.\nThe attack flow commences when an attacker, capable of writing to or appending to a file being monitored by the Wazuh agent's logcollector, injects a specially crafted multi-line payload. As the agent processes this malicious file, the logcollector reads the data into the vulnerable buffer. Due to the lack of adequate bounds checking, the excess input overflows the stack memory space.\nOn 32-bit Windows environments, the vulnerability is particularly exploitable because the stack layout allows for the overwriting of Structured Exception Handling (SEH) frames. By precisely crafting the payload to control the SEH chain, an attacker can redirect execution flow when an exception is triggered, potentially executing arbitrary shellcode with the elevated privileges of the Wazuh agent process, which typically runs as SYSTEM.\nThe exploitation does not require prior authentication to the Wazuh agent itself, provided the attacker has write access to the monitored log file. The payload behavior involves corrupting stack-based data structures to redirect the instruction pointer. The post-exploitation impact includes full compromise of the local agent host, as the attacker achieves code execution in the context of the SYSTEM user, granting them complete control over the host's operating system, file system, and network configurations. This vulnerability affects all Wazuh agent versions from 1.0.0 through 4.14.8."
}