CVE-2026-40106Medium· 4.7▾ SunlitWazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Wi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.10%
0.10% → 0.1%
Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed-size heap buffer of 256 bytes (OS_SIZE_256). By creating a registry subkey with a maximum allowed length (255 characters) inside a monitored path, a low-privileged local attacker can force an out-of-bounds write during string concatenation. Since wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, this can lead to a silent Denial of Service (blinding the agent) or potentially Local Privilege Escalation (LPE). This issue has been fixed in version 4.14.5.
wazuh >= 4.6.0, < 4.14.5Upgrade past the affected range:
wazuh 4.14.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44251Medium· 6.5Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-44256Medium· 5.3Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-44253Medium· 4.9Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-45798High· 7.5Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-48024Critical· 9.1Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-48162Critical· 9.1Wazuh is a free and open source platform used for threat prevention, detection, and response