Wazuh up to 4.14.2 Database Synchronization wdb_delta_event.c stack-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in Wazuh up to 4.14.2. This vulnerability affects unknown code of the file wdb_delta_event.c of the component Database Synchronization Module. This manipulation causes stack-based overflow. The identification of this vulnerability is CVE-2026-25772. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Wazuh up to 4.14.2 and classified as critical. Affected by this vulnerability is some unknown functionality of the file wdb_delta_event.c of the component Database Synchronization Module. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.14.3, a stack-based buffer overflow vulnerability exists in the Wazuh Database synchronization module (`wdb_delta_event.c`). The SQL query construction logic allows for an integer underflow when calculating the remaining buffer size. This occurs because the code incorrectly aggregates the return value of `snprintf`. If a specific database synchronization payload exceeds the size of the query buffer (2048 bytes), the size calculation wraps around to a massive integer, effectively removing bounds checking for subsequent writes. This allows an attacker to corrupt the stack, leading to a Denial of Service (DoS) or potentially RCE. Version 4.14.3 fixes the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-25772 since 02/05/2026. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 4.14.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0771). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source Wazuh

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion