Listen to this Post
CVE-2026-44251 is a vulnerability in the Wazuh security platform that arises from an unsigned integer underflow in the `ReadSecMSG` function within os_crypto/shared/msgs.c. Wazuh is an open-source unified threat prevention, detection, and response solution. Its `wazuh-remoted` daemon is responsible for parsing encrypted and compressed messages exchanged between the manager and enrolled agents. The `ReadSecMSG` function handles the decompression and parsing of these messages.
The root cause is a `size_t` integer underflow at line 389 of msgs.c. After zlib decompression, the code calculates the final message length by subtracting a fixed header offset from the decompressed size: final_size -= (f_msg - buffer). However, it does not validate that the decompressed length is greater than the combined size of the fixed-format header, which consists of an MD5 checksum (32 bytes), random data (5 bytes), a global counter (10 bytes), a colon separator (1 byte), a local counter (4 bytes), and another colon (1 byte) — totaling 53 bytes.
An enrolled agent can send a specially crafted, overly short compressed payload. When decompressed, the resulting plaintext length is smaller than the 53-byte header offset. The subtraction operation then underflows because `size_t` is unsigned; subtracting a larger value from a smaller one wraps the result to `SIZE_MAX` (18,446,744,073,709,551,615 on 64-bit systems). This gargantuan value is subsequently used in memory operations, immediately causing the `wazuh-remoted` process to crash. The crash disconnects every agent from the manager, resulting in a denial-of-service (DoS) condition.
Beyond the immediate crash, a secondary code path reachable through the same underflow may allow heap memory corruption. This occurs because the underflowed size can lead to out-of-bounds reads or writes on the heap, potentially enabling an attacker to overwrite adjacent memory structures. The vulnerability affects all Wazuh versions from 3.0.0 up to but not including 4.14.5. It was fixed in version 4.14.5 by introducing a `MSG_OVERHEAD` constant (53 bytes) and adding a validation check immediately after decompression. If the decompressed size is less than MSG_OVERHEAD, the function logs a warning and returns an error, preventing the underflow from occurring.
The CVSS score assigned by GitHub, Inc. is 6.5 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. A proof-of-concept exploit is publicly available.
DailyCVE Form:
Platform: ……. Wazuh Manager
Version: …….. 3.0.0–4.14.4
Vulnerability :…… Integer Underflow
Severity: ……. Medium (CVSS 6.5)
date: ………. 2026-07-16
Prediction: ……. 2026-04-23 (fixed)
What Undercode Say:
- Analytics: The vulnerability resides in the message parsing routine of the `wazuh-remoted` process. An authenticated agent can send a malformed compressed message that, after zlib decompression, yields a plaintext shorter than the 53-byte fixed header. The subsequent `size_t` subtraction underflows, causing the process to crash or corrupt heap memory.
- Bash Commands & Codes:
- Check Wazuh version:
/var/ossec/bin/wazuh-control info
- Verify if the system is vulnerable (versions 3.0.0 to 4.14.4):
VERSION=$(/var/ossec/bin/wazuh-control info | grep version | awk '{print $3}') if [[ "$VERSION" < "4.14.5" && "$VERSION" >= "3.0.0" ]]; then echo "Vulnerable"; else echo "Not vulnerable"; fi - Simulate a malformed message (conceptual – not a full exploit):
Craft a minimal compressed payload that decompresses to < 53 bytes echo -n "short" | gzip -c > payload.gz Send via netcat (example, requires agent key) nc -u manager_ip 1514 < payload.gz
- Monitor `wazuh-remoted` logs for crashes:
tail -f /var/ossec/logs/ossec.log | grep -i "remoted"
Exploit:
An enrolled agent with network access to the manager can send a compressed message that decompresses to a plaintext shorter than 53 bytes. The underflow occurs in the `ReadSecMSG` function, causing the `wazuh-remoted` daemon to crash. This immediately disconnects all agents, effectively halting log collection and threat detection. The exploit requires low privileges (agent enrollment) and no user interaction. A publicly available proof-of-concept exists.
Protection:
- Upgrade Wazuh to version 4.14.5 or later immediately.
- If upgrading is not possible, restrict network access to the manager’s remoted port (1514/UDP) to only trusted agents.
- Monitor logs for unexpected `wazuh-remoted` crashes and investigate any anomalous agent messages.
- Apply the fix from pull request 35193, which adds length validation after decompression.
Impact:
- Availability: High – successful exploitation crashes
wazuh-remoted, disconnecting all agents and stopping security monitoring. - Confidentiality: None – the vulnerability does not expose sensitive data.
- Integrity: None – no data modification occurs.
- Secondary: Potential heap corruption could lead to arbitrary code execution or further memory corruption, though this is less straightforward.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
