PT-2026-25925 · Wazuh · Wazuh

Skraft9 · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-25772

NVD

CVSS v3.1

4.9

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.14.3, a stack-based buffer overflow vulnerability exists in the Wazuh Database synchronization module (wdb delta event.c). The SQL query construction logic allows for an integer underflow when calculating the remaining buffer size. This occurs because the code incorrectly aggregates the return value of snprintf. If a specific database synchronization payload exceeds the size of the query buffer (2048 bytes), the size calculation wraps around to a massive integer, effectively removing bounds checking for subsequent writes. This allows an attacker to corrupt the stack, leading to a Denial of Service (DoS) or potentially RCE. Version 4.14.3 fixes the issue.

Fix

Integer Underflow

Stack Overflow

Weakness Enumeration

CWE-191

CWE-121

Related Identifiers

CVE-2026-25772

Affected Products

Wazuh

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-25772 · Security Note
• https://github.com/wazuh/wazuh/security/advisories/GHSA-h7vp-j34v-h6j5 · Note