CVE-2026-40106 Details
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed-size heap buffer of 256 bytes (OS_SIZE_256). By creating a registry subkey with a maximum allowed length (255 characters) inside a monitored path, a low-privileged local attacker can force an out-of-bounds write during string concatenation. Since wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, this can lead to a silent Denial of Service (blinding the agent) or potentially Local Privilege Escalation (LPE). This issue has been fixed in version 4.14.5.
A heap-based buffer overflow vulnerability has been identified in the Wazuh agent for Windows, specifically in the syscheck component. This vulnerability affects Wazuh versions 4.6.0 and above, prior to 4.14.5. The issue arises when the agent expands registry paths containing wildcards, leading to an out-of-bounds write during string concatenation. A low-privileged local attacker can exploit this by creating a registry subkey with a maximum length of 255 characters inside a monitored path. Since the Wazuh agent runs with NT AUTHORITY\SYSTEM privileges, this vulnerability can cause a silent denial-of-service by crashing the agent or potentially allow local privilege escalation.
Users can upgrade to Wazuh version 4.14.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wazuh wazuh | >= 4.6.0, < 4.14.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |