CVE-2026-112334 in Wazuh
Summary
by MITRE • 11/06/2026
Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in Wazuh versions prior to 4.14.9 represents a critical out-of-bounds write flaw located within the wazuh-execd daemon component. This security defect arises from insufficient boundary checking when processing configuration files, specifically affecting how the system handles active-response commands defined by privileged manager-configuration attackers. The core technical issue lies in the ReadExecConfig function, which is responsible for parsing and loading execution configurations into memory arrays. When an attacker controls the ossec.conf file on a Wazuh manager, they can inject malicious configuration blocks that specify an excessive number of active-response commands. Specifically, if more than sixty-four commands are pushed to agents through these blocks, the internal data structures fail to accommodate the input volume correctly.
This architectural limitation leads directly to memory corruption as the system attempts to write beyond the allocated bounds of its arrays. The overflow corrupts root process memory because wazuh-execd typically operates with elevated privileges necessary for monitoring and responding to security events on endpoints. By exploiting this out-of-bounds write, an attacker can manipulate adjacent memory regions or overwrite critical control data within the daemon's address space. Such corruption destabilizes the integrity of the running process, creating a pathway for potential remote code execution if the overwritten memory contains function pointers or return addresses that can be controlled by the adversary.
The operational impact of this vulnerability is severe due to its ability to disrupt security operations at scale. An attacker who successfully exploits this flaw can crash the Active Response fleet-wide, effectively neutralizing one of Wazuh's primary defensive capabilities. Active responses are automated actions triggered by detected threats, such as blocking an IP address or killing a malicious process. By causing these daemons to fail across multiple agents, the vulnerability creates a significant blind spot in organizational security posture. This denial-of-service effect allows attackers to operate undetected while simultaneously degrading the monitoring infrastructure's ability to react to ongoing intrusions.
From a classification perspective, this flaw aligns with CWE-787: Out-of-bounds Write, which describes writing data outside of the intended buffer boundaries. Furthermore, the exploitation vector relates to ATT&CK technique T1059 Command and Scripting Interpreter through the abuse of configuration files that trigger automated scripts or commands. The vulnerability also touches upon CWE-269: Improper Privilege Escalation since it requires a privileged attacker with access to manager configurations but impacts root-level processes, potentially leading to higher privilege compromise depending on the specific memory layout exploitation outcomes.
Mitigation strategies must prioritize immediate patching of all Wazuh installations to version 4.14.9 or later where this boundary check has been corrected. In environments where upgrading is not immediately feasible, administrators should enforce strict access controls over ossec.conf files and other configuration directories accessible by the manager service. Implementing file integrity monitoring on these critical configuration paths can alert security teams to unauthorized modifications that attempt to inject excessive active-response commands. Additionally, limiting the scope of privileges for accounts capable of editing Wazuh configurations reduces the attack surface available to potential adversaries seeking to trigger this memory corruption flaw.