Out-of-Bounds Write in Wazuh Affects Privileged Configuration Management

CVE-2026-112334

What is CVE-2026-112334?

Wazuh versions from 1.0.0 prior to 4.14.9 are susceptible to an out-of-bounds write vulnerability within its wazuh-execd component. This security flaw enables attackers with the ability to manipulate manager configuration files to funnel excess entries into the ar.conf file, resulting in potential corruption of the root process memory. Specifically, this vulnerability can be exploited through active-response blocks in ossec.conf, allowing bad actors to inundate agents with over 64 commands, triggering an overflow in the ReadExecConfig() arrays. This could lead to system crashes affecting the entire Active Response fleet.

References