CVE-2026-44254

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44254", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-08-19T16:09:55.307Z", "dateUpdated": "2026-08-19T18:18:27.247Z"}, "containers": {"cna": {"title": "Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path", "problemTypes": [{"descriptions": [{"cweId": "CWE-131", "lang": "en", "description": "CWE-131: Incorrect Calculation of Buffer Size", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq"}, {"name": "https://github.com/wazuh/wazuh/pull/35773", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/pull/35773"}, {"name": "https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96"}, {"name": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6"}, {"name": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "tags": ["x_refsource_MISC"], "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2"}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"version": ">= 1.0.0, < 4.14.6", "status": "affected"}, {"version": ">= 5.0.0-beta1, < 5.0.0-beta2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T16:09:55.307Z"}, "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}], "source": {"advisory": "GHSA-9wm4-fp6c-hqgq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T18:03:36.678329Z", "id": "CVE-2026-44254", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:18:27.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44254", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:03:36.678329Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:03:37.729Z"}}], "cna": {"title": "Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path", "source": {"advisory": "GHSA-9wm4-fp6c-hqgq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": ">= 1.0.0, < 4.14.6"}, {"status": "affected", "version": ">= 5.0.0-beta1, < 5.0.0-beta2"}]}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wazuh/wazuh/pull/35773", "name": "https://github.com/wazuh/wazuh/pull/35773", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96", "name": "https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "name": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "name": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-131", "description": "CWE-131: Incorrect Calculation of Buffer Size"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T16:09:55.307Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44254", "state": "PUBLISHED", "dateUpdated": "2026-08-19T18:18:27.247Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T16:09:55.307Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wazuh", "vendor": "wazuh", "versions": [{"status": "affected", "version": ">= 1.0.0, < 4.14.6"}, {"status": "affected", "version": ">= 5.0.0-beta1, < 5.0.0-beta2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "matchCriteriaId": "48D41B6B-16D4-46DD-8349-7C4F82D78C2E", "versionEndExcluding": "4.14.6", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "007B01AA-AED0-4E92-8999-07E74B630460", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2."}, {"lang": "es", "value": "Wazuh es una plataforma de c\u00f3digo abierto y gratuita utilizada para la prevenci\u00f3n, detecci\u00f3n y respuesta a amenazas. Desde 1.0.0 hasta 4.14.6 y 5.0.0-beta2, HandleSecureMessage() en src/remoted/secure.c pasa un puntero dentro de su b\u00fafer de pila a ReadSecMSG(), y src/os_crypto/shared/msgs.c descomprime hasta OS_MAXSTR bytes en ese desplazamiento. Para un mensaje de agente cifrado en el puerto TCP 1514 que se expande a 65.536 bytes, os_zlib_uncompress() escribe un byte nulo de terminaci\u00f3n m\u00e1s all\u00e1 del final del b\u00fafer de destino. La escritura fuera de l\u00edmites de la pila resultante en el demonio remoto de nivel ra\u00edz puede bloquear el procesamiento de mensajes e interrumpir las comunicaciones del agente. Este problema est\u00e1 solucionado en las versiones 4.14.6 y 5.0.0-beta2."}], "id": "CVE-2026-44254", "lastModified": "2026-10-27T11:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44254", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T18:03:36.678329Z", "version": "2.0.3"}}]}, "published": "2026-08-19T16:17:10.967", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/wazuh/wazuh/pull/35773"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,4.14.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-beta1,5.0.0-beta2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wazuh", "source": "cna", "vendor": "wazuh"}, "product": "wazuh", "vendor": "wazuh"}], "created": "2026-08-19T18:00:05.506021+00:00", "updated": "2026-08-20T14:30:03.634409+00:00", "vendors": ["wazuh", "wazuh$PRODUCT$wazuh"]}