Heap-Based Buffer Overflow in Wazuh Agent for Windows

CVE-2026-40106

What is CVE-2026-40106?

The Wazuh Agent for Windows has a heap-based buffer overflow vulnerability in its syscheck component, affecting versions 4.6.0 and higher up to 4.14.4. The issue arises when the agent handles registry paths with wildcards and allocates a fixed-size heap buffer of 256 bytes. A local attacker can exploit this by creating a specially crafted registry subkey, triggering out-of-bounds writes during string operations. Given that the agent runs with SYSTEM privileges, this can lead to denial of service or enable local privilege escalation. Users are encouraged to update to version 4.14.5 or later to mitigate this issue. For more details, visit the Wazuh advisory.

References