Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.
Affected products
wazuh: wazuh
References3
- github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3 Vendor Advisory
- github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3 Vendor Advisory
- github.com/wazuh/wazuh/releases/tag/v4.14.4 Release Notes
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 17 · as of 13 November 2026
- CWE
- CWE-124CWE-191
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.