Stack-Based Buffer Overflow in Wazuh Agent Logcollector by Wazuh

CVE-2026-112335

What is CVE-2026-112335?

The Wazuh Agent, specifically in versions prior to 4.14.9, contains a vulnerability in the logcollector's snort-full log reader. This vulnerability is due to an improper calculation of remaining buffer space in the read_snortfull() function. Attackers can exploit this vulnerability by feeding crafted multi-line content into a monitored snort-full log. This action can lead to an overflow of a 65,280-byte stack buffer, potentially causing the agent to crash or allowing for the overwriting of an SEH handler, especially on 32-bit Windows systems operating under SYSTEM privileges.

References