Stack Buffer Overflow Vulnerability in Wazuh Threat Detection Platform
CVE-2026-45798
What is CVE-2026-45798?
Wazuh, a robust open-source platform designed for threat prevention, detection, and response, has a vulnerability where the function compare_wazuh_versions() improperly handles an attacker-controlled version string. This vulnerability exists in versions 4.5.0 to 4.14.6 and 5.0.0-beta2. When the anonymous TLS enrollment is enabled, the function can be accessed without authentication through wazuh-authd on TCP port 1515. The lack of explicit buffer termination when copying the version string can lead to the corruption of adjacent stack memory, potentially resulting in a remote denial of service. This issue has been addressed in later versions 4.14.6 and 5.0.0-beta2.
Affected Version(s)
wazuh >= 4.5.0, < 4.14.6 < 4.5.0, 4.14.6
wazuh >= 5.0.0-beta1, < 5.0.0-beta2 < 5.0.0-beta1, 5.0.0-beta2