CVE-2026-25790 in Wazuh
Summary
by MITRE • 03/17/2026
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, multiple stack-based buffer overflows exist in the Security Configuration Assessment (SCA) decoder (`wazuh-analysisd`). The use of `sprintf` with a floating-point (`%lf`) format specifier on a fixed-size 128-byte buffer allows a remote attacker to overflow the stack. A specially crafted JSON event can trigger this overflow, leading to a denial of service (crash) or potential RCE on the Wazuh manager. The vulnerability is located in `/src/analysisd/decoders/security_configuration_assessment.c`, within the `FillScanInfo` and `FillCheckEventInfo` functions. In multiple locations, a 128-byte buffer (`char value[OS_SIZE_128];`) is allocated on the stack to hold the string representation of a number from a JSON event. The code checks if the number is an integer or a double. If it's a double, it uses `sprintf(value, "%lf", ...)` to perform the conversion. This `sprintf` call is unbounded. If a floating-point number with a large exponent (e.g., `1.0e150`) is provided, `sprintf` will attempt to write its full string representation (a "1" followed by 150 zeros), which is larger than the 128-byte buffer, corrupting the stack. Version 4.14.3 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
The vulnerability identified as CVE-2026-25790 represents a critical stack-based buffer overflow in the Wazuh security platform's Security Configuration Assessment (SCA) decoder component. This flaw exists in the wazuh-analysisd daemon and affects versions between 3.9.0 and 4.14.2 inclusive, making it a long-standing issue that has persisted across multiple major releases. The vulnerability stems from improper input validation and unsafe string formatting practices within the security assessment functionality that processes JSON events containing numerical data. The flaw specifically manifests in the FillScanInfo and FillCheckEventInfo functions located in the security_configuration_assessment.c source file, where developers have employed the dangerous sprintf function with floating-point format specifiers on fixed-size buffers.
The technical implementation of this vulnerability exploits a fundamental weakness in memory management and string handling within the Wazuh analysis daemon. When processing JSON events containing numeric values, the code allocates a 128-byte character buffer named value[OS_SIZE_128] on the stack to store string representations of numbers. The problematic code path occurs when the system encounters floating-point numbers, specifically when the number is identified as a double type rather than an integer. In these cases, the code invokes sprintf(value, "%lf", ...) which performs no bounds checking against the fixed 128-byte buffer. This particular usage pattern creates an exploitable condition because the %lf format specifier can produce extremely long string representations for floating-point numbers with large exponents, such as 1.0e150 which would require hundreds of characters to represent fully.
The operational impact of this vulnerability extends beyond simple denial of service to potentially enable remote code execution on affected Wazuh managers. A remote attacker who can submit specially crafted JSON events to the Wazuh manager can trigger the buffer overflow condition, causing the application to crash or potentially execute arbitrary code with the privileges of the wazuh-analysisd process. The stack corruption occurs because sprintf writes beyond the allocated 128-byte buffer boundaries when handling large floating-point exponents, allowing attackers to overwrite adjacent stack memory including return addresses and function parameters. This type of vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which specifically addresses buffer overflows where data written to a stack buffer exceeds its allocated size. The attack vector is particularly concerning because it requires no authentication and can be exploited through the standard Wazuh manager communication interfaces, making it accessible to any remote attacker with network access to the vulnerable system.
The mitigation strategy for CVE-2026-25790 involves upgrading to Wazuh version 4.14.3 or later, which contains the necessary patches to address the buffer overflow vulnerability. Organizations should prioritize this upgrade as a critical security measure, particularly in environments where Wazuh managers are exposed to untrusted network traffic. Beyond the immediate patching, system administrators should implement additional monitoring and logging to detect potential exploitation attempts through malformed JSON events. The vulnerability also highlights the importance of secure coding practices, specifically avoiding dangerous functions like sprintf in favor of safer alternatives such as snprintf which provide explicit bounds checking. From an operational security perspective, this vulnerability demonstrates the necessity of input validation and sanitization at all levels of security software, particularly in components that process external data from network sources. The ATT&CK framework would categorize this vulnerability under T1190 Exploit Public-Facing Application, as it represents an exploitation of a publicly known vulnerability in a security tool that is designed to be exposed to network traffic. Organizations should also consider implementing network segmentation and access controls to limit exposure of Wazuh managers to untrusted networks, while maintaining regular vulnerability scanning to identify similar issues in other security tools and applications.