CVE-2026-44251 Details
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents from the manager. A second code path reached by the same underflow may allow heap memory corruption. This issue has been fixed in version 4.14.5.
A size_t integer underflow vulnerability has been identified in Wazuh Manager versions 3.0.0 and above, prior to 4.14.5. The issue resides in the 'ReadSecMSG' function of 'os_crypto/shared/msgs.c', where the absence of a minimum-length guard allows enrolled Wazuh agents to send crafted messages that cause the 'wazuh-remoted' process to crash. This disconnection affects all agents connected to the manager. Additionally, the same underflow could lead to heap memory corruption, potentially allowing remote code execution as the 'wazuh' user, depending on the behavior of 'malloc(0)' and the runtime memory layout.
Users can upgrade to Wazuh Manager version 4.14.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5r-5p7c-g9fq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5r-5p7c-g9fq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wazuh wazuh | >= 3.0.0, < 4.14.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |