---
id: CVE-2026-44254
title: >-
  Wazuh is a free and open source platform used for threat prevention,
  detection, and response
summary: >-
  Wazuh is a free and open source platform used for threat prevention,
  detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2,
  HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its
  stack buffer to ReadSecMSG()…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-131
  - CWE-787
vendor: wazuh
product: wazuh
affected:
  - 'wazuh >= 1.0.0, < 4.14.6'
  - wazuh = 5.0.0
patched:
  - wazuh 4.14.6
published: '2026-08-19'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T14:54:45.570'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44254'
references:
  - url: >-
      https://github.com/wazuh/wazuh/commit/96772487fbdecd43cc83e284ee7aeb45e3cfcd96
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/pull/35773'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/releases/tag/v4.14.6'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/releases/tag/v5.0.0-beta2'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00497
epssPercentile: 0.40081
ingestedAt: '2026-09-09T21:22:45.539Z'
---

## Overview

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage() in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG(), and src/os_crypto/shared/msgs.c decompresses up to OS_MAXSTR bytes at that offset. For an encrypted agent message on TCP port 1514 that expands to 65,536 bytes, os_zlib_uncompress() writes a terminating null byte beyond the end of the destination buffer. The resulting stack out-of-bounds write in the root-level remoted daemon can crash message processing and disrupt agent communications. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

## Affected

- `wazuh >= 1.0.0, < 4.14.6`
- `wazuh = 5.0.0`

## Remediation

Upgrade past the affected range:

- `wazuh 4.14.6`