PT-2026-25925 · Wazuh · Wazuh

Skraft9 · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-25772

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.2

Description Wazuh is a free and open source platform used for threat prevention, detection, and response. A stack-based buffer overflow exists in the Wazuh Database synchronization module (wdb delta event.c). The SQL query construction logic allows for an integer underflow when calculating the remaining buffer size due to the incorrect aggregation of the return value of snprintf. If a database synchronization payload exceeds the query buffer size (2048 bytes), bounds checking is removed for subsequent writes, allowing an attacker to corrupt the stack, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE).

Recommendations Versions prior to 4.14.3 should be updated to version 4.14.3 or later.

Exploit

Fix

Integer Underflow

Stack Overflow

Weakness Enumeration

CWE-191

CWE-121

Related Identifiers

BDU:2026-05080

CVE-2026-25772

GHSA-H7VP-J34V-H6J5

Affected Products

Wazuh

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25772.json · Exploit
• https://github.com/wazuh/wazuh/security/advisories/GHSA-h7vp-j34v-h6j5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25772 · Security Note
• https://bdu.fstec.ru/vul/2026-05080 · Security Note
• https://twitter.com/VulmonFeeds/status/2034055695746617369 · Twitter Post
• https://twitter.com/CVEnew/status/2033994256222982650 · Twitter Post