← Vulnerability feed

Vulnerability record · CVE-2026-34150 · published 17 July 2026

CVE-2026-34150: Wazuh heap-based buffer overflow vulnerability

Wazuh · Wazuh

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing  {key: value}  patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.

7.5 CVSS 3.1 High EPSS 0.37% · top 71.8% CWE-122 · Heap-based buffer overflow
7.5CVSS 3.1 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
20 Jul 2026Last modified by NVD

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing  {key: value}  patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883 ExploitMitigationVendor Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-rvr9-89q8-w883 ExploitMitigationVendor Advisory

Track CVE-2026-34150 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2025-24016Wazuh server unsafe deserialization allows remote code executionWazuh versions 4.4.0 through 4.9.0 deserialize DistributedAPI parameters with an unsafe helper (as_wazuh_object), letting an attacker who can inject …KEVEPSS 94%analysed9.9CVE-2026-30893Wazuh path traversal vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path tra…EPSS 0.62%9.8CVE-2024-32038Wazuh heap-based buffer overflow vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd wh…EPSS 1.0%9.8CVE-2021-44079Wazuh command injection vulnerabilityIn the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting…EPSS 3.4%9.5CVE-2024-1243Wazuh improper input validation vulnerabilityImproper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to…EPSS 0.64%9.1CVE-2026-61800Wazuh path traversal vulnerabilityWazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14…EPSS 0.98%9.1CVE-2026-49441Wazuh vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged…EPSS 0.77%9.1CVE-2026-48024Wazuh path traversal vulnerabilityWazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerg…EPSS 0.78%

Source: NIST National Vulnerability Database (record CVE-2026-34150), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.