Read the docs
TI-2026-85939 Aliases CVE-2026-112334

Out-of-bounds write in Wazuh wazuh-execd via ar.conf

Priority LOW 31CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write in wazuh-execd. An attacker with privileged access to the manager configuration can add more than 64 active response commands to ossec.conf, which overflows arrays in ReadExecConfig() and corrupts root process memory. The overflow crashes Active Response on all agents.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.

Why it matters now

EPSS 0.00562 46th percentileScored 2026-11-07
Fix Fixed wazuh (wazuh): 4.14.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wazuhwazuh1.0.0 to before 4.14.94.14.9Patch availableCNA
  • wazuh VendorWazuh Affected 1.0.0 to before 4.14.9 Fixed in 4.14.9 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*——Wazuh
  • cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* Versions — — ·Wazuh

Remediation

Upgrade Wazuh to version 4.14.9 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wazuh (wazuh) Fixed in 4.14.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    wazuh 4.14.9

    7 records Highest priority Priority HIGH 1 HIGH, 6 LOW

    Other records, highest priority first

    • TI-2026-85943 Server-side request forgery in Wazuh GitHub module leaks API tokenPriority HIGH 69
    • TI-2026-85944 Missing TLS hostname verification in Wazuh fluent-forward modulePriority LOW 35
    • TI-2026-85941 Wazuh Manager JSON Decoder Memory Leak Enables Denial of ServicePriority LOW 32
    Show all 7 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-112334
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 1

  • TI-2025-17783 Remote code execution in Wazuh server KEVCVSS 3.1CRITICAL 9.9
  • TI-2026-47604 Wazuh GitHub Actions Shell Injection via Fork Pull Request CVSS 4.0CRITICAL 9.3
  • TI-2026-71739 Missing origin check in Wazuh manager allows arbitrary file read CVSS 4.0HIGH 8.7
  • TI-2026-71743 Arbitrary file overwrite in Wazuh manager enables root code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-23722 Path traversal in wazuh CVSS 3.1CRITICAL 9.9
  • TI-2024-01157 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft CVSS 4.0CRITICAL 9.5
See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences