PT-2026-25925 · Wazuh · Wazuh

Skraft9 · Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-25772

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.2

Description Wazuh is a free and open source platform used for threat prevention, detection, and response. A stack-based buffer overflow exists in the Wazuh Database synchronization module (wdb delta event.c). The SQL query construction logic allows for an integer underflow when calculating the remaining buffer size due to the incorrect aggregation of the return value of snprintf. If a database synchronization payload exceeds the query buffer size (2048 bytes), bounds checking is removed for subsequent writes, allowing an attacker to corrupt the stack, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE).

Recommendations Versions prior to 4.14.3 should be updated to version 4.14.3 or later.

Exploit

Correção

Integer Underflow

Stack Overflow

Enumeração de Fraquezas

CWE-191

CWE-121

Identificadores relacionados

BDU:2026-05080

CVE-2026-25772

GHSA-H7VP-J34V-H6J5

Produtos afetados

Wazuh

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25772.json · Exploit
• https://github.com/wazuh/wazuh/security/advisories/GHSA-h7vp-j34v-h6j5 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25772 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25772 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034055695746617369 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033994256222982650 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05080 · Nota de Segurança