Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing a remote denial of service. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T17:18:49.730Z",
  "pubdate": "2026-08-19T17:18:49.730Z",
  "executiveSummary": "A denial of service vulnerability exists within the Wazuh open-source threat prevention, detection, and response platform. Specifically, the flaw affects versions from 4.5.0 until 4.14.6 and 5.0.0-beta2. The vulnerability stems from improper buffer handling in the compare_wazuh_versions function located within src/shared/version_op.c, where the attacker-controlled enrollment V: field is copied into a constrained 10-byte stack buffer using strncpy without ensuring explicit null termination.\nThis flaw allows an unauthenticated remote attacker to cause a denial of service. The vulnerable function is exposed pre-authentication via wazuh-authd listening on TCP port 1515, provided that anonymous TLS enrollment is enabled. By supplying a crafted version string containing at least nine non-null bytes, an adversary forces subsequent string operations like strchr and strtok to read beyond the boundaries of the ver2 buffer and causes strtok to write a null byte into adjacent stack memory.\nThe risk implication involves service disruption and potential daemon crashes, impacting system availability. Exploitation requires network access to TCP port 1515 and specific configuration parameters, namely the enablement of anonymous TLS enrollment, but does not require prior authentication or valid user privileges.",
  "technicalDetails": "The vulnerability resides in the compare_wazuh_versions() function situated in src/shared/version_op.c within the Wazuh platform. The root cause of the issue is an unsafe string copy operation combined with a lack of explicit buffer termination. When processing agent registration data, the function copies the attacker-controlled enrollment V: field into a fixed-size 10-byte stack-allocated buffer using the strncpy() function.\nBecause strncpy() does not guarantee null termination if the source string length meets or exceeds the destination buffer size, the target buffer ver2 lacks a terminating null byte when populated with a sufficiently long input. Subsequently, the program invokes string manipulation routines, specifically strchr() and strtok(), which rely on standard null-terminated string assumptions.\nThe attack flow proceeds as follows: an unauthenticated remote attacker establishes a network connection to the wazuh-authd daemon running on TCP port 1515. This attack vector is reachable prior to authentication under conditions where anonymous TLS enrollment is explicitly enabled. The attacker transmits a malicious enrollment payload containing a specially crafted version string within the V: field that consists of at least nine non-null bytes.\nUpon processing this payload, the un-terminated 10-byte stack buffer causes strchr() and strtok() to read past the intended boundary of ver2 into adjacent stack memory regions. Furthermore, the invocation of strtok() attempts to locate token delimiters within the malformed memory structure, resulting in a write operation that places a null byte into adjacent stack memory. This out-of-bounds write corrupts critical stack variables or control structures, leading immediately to application instability and a remote denial of service via daemon termination.\nThe affected component is the version comparison logic in wazuh-authd. The vulnerable software versions span from 4.5.0 through 4.14.6 (excluding the fixed version) and include 5.0.0-beta2. No authentication or elevated privileges are required by the attacker, provided the network exposure and anonymous TLS enrollment prerequisites are met."
}