Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T16:17:10.967Z",
  "pubdate": "2026-08-19T16:17:10.967Z",
  "executiveSummary": "A stack out-of-bounds write vulnerability exists in the Wazuh platform, specifically affecting the root-level remoted daemon across versions 1.0.0 through 4.14.6 and including 5.0.0-beta2. The flaw resides within the message handling routines where encrypted agent communications are processed. Specifically, the function HandleSecureMessage() passes a pointer situated inside its stack buffer directly to ReadSecMSG(). Subsequently, the os_zlib_uncompress() function located in src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at the specified offset. When processing an encrypted agent message transmitted over TCP port 1514 that expands to precisely 65,536 bytes, os_zlib_uncompress() appends a terminating null byte past the boundary of the designated destination buffer. This unauthorized memory modification results in a stack-based out-of-bounds write condition. The primary operational impact of this vulnerability is a denial of service, as the resulting memory corruption crashes message processing and disrupts critical agent-to-manager communications. Successful exploitation requires network connectivity to the remoted daemon on TCP port 1514 and the ability to transmit a maliciously crafted or specially manipulated encrypted agent message that yields the target expansion size during decompression, operating without prior authentication.",
  "technicalDetails": "The vulnerability is a classic stack out-of-bounds write stemming from unsafe buffer management and decompression handling within the Wazuh remoted daemon. The vulnerable component is the message ingestion and cryptographic processing pipeline implemented across src/remoted/secure.c and src/os_crypto/shared/msgs.c. Affected versions include all deployments of Wazuh from 1.0.0 up to 4.14.6, as well as version 5.0.0-beta2. The root cause of the issue lies in how memory pointers are allocated, referenced, and passed into decompression routines. During standard operations, the function HandleSecureMessage() initializes a local stack buffer and provides a pointer referencing an interior offset within this stack structure to ReadSecMSG(). This pointer dictates where the incoming payload will be processed and decompressed.\nThe attack flow begins when an unauthenticated adversary establishes a network connection to TCP port 1514, which is exposed by the root-level Wazuh remoted daemon for agent communication. The attacker transmits a specially formatted, encrypted agent message designed to exploit the sizing mechanics of the decompression routine. As the data enters the processing pipeline, the os_zlib_uncompress() function in src/os_crypto/shared/msgs.c decompresses the payload into the memory location designated by the stack pointer. When the compressed stream expands to a specific threshold of 65,536 bytes, the decompression routine attempts to write a terminating null byte. Because the offset calculation combined with the expansion size exceeds the allocated boundaries of the destination stack buffer, this terminating null byte is written beyond the end of the buffer.\nThis out-of-bounds write corrupts adjacent stack memory structures within the context of the root-level remoted daemon. Depending on the precise layout of the stack frame, this memory corruption overwrites critical control data, saved frame pointers, or return addresses. The immediate post-exploitation impact is the abrupt termination of the message processing thread or the entire remoted daemon due to segmentation faults or stack integrity validation failures. Consequently, this disrupts all communication channels between endpoints and the Wazuh manager, leading to a complete loss of centralized threat detection, prevention, and response visibility for the affected infrastructure. No authentication or elevated privileges are required to initiate the attack flow, provided network access to TCP port 1514 is available to the malicious actor."
}