Heap-Based Vulnerability in Wazuh Threat Detection Platform

CVE-2026-26204

What is CVE-2026-26204?

The vulnerability in Wazuh affects versions from 1.0.0 up to 4.14.3, where a heap-based out-of-bounds write occurs in the GetAlertData function. This issue leads to the writing of a NULL byte just before the allocated buffer, primarily due to unsigned integer underflow and pointer arithmetic wrapping. This flaw allows potential attackers to exploit the system through a compromised agent, which may inject malicious alerts into the monitored log file. Such actions can result in denial of service or heap corruption. The vulnerability has been addressed in version 4.14.4.

References