Listen to this Post
How CVE-2026-34150 Works
CVE-2026-34150 is a critical heap buffer overflow vulnerability discovered in Wazuh, an open-source security monitoring and SIEM platform. The flaw resides in the `wazuh-analysisd` component, which is responsible for processing security events and generating alerts. Affected versions range from 1.0.0 up to, but not including, 4.14.5. The vulnerability stems from insufficient input validation when parsing rootcheck events, specifically within the `W_JSON_ParseRootcheck` function defined in src/analysisd/format/json_extended.c.
In the vulnerable code, a 30-byte heap buffer is allocated using `malloc((MAX_STRING_LESS) sizeof(char))` where `MAX_STRING_LESS` is defined as 30. Later, a regular expression `\\{([A-Za-z0-9_]: [A-Za-z0-9_., ])\\}` extracts key-value pairs from rootcheck event data. The extracted content is written into the 30-byte buffer using an unbounded `sprintf` call: sprintf(results
, "%.s", (finish - start), to_match + start)</code>. If the captured key-value pattern exceeds 30 bytes, `sprintf` continues writing past the buffer boundary, corrupting adjacent heap metadata and causing the `wazuh-analysisd` process to crash.
The attack is particularly dangerous because it exploits the default configuration shipped in the official `wazuh/wazuh-docker` deployment. In this default setup, agent enrollment via `authd` (port 1515/TLS) does not require a password (<code><use_password>no</use_password></code>), allowing an unauthenticated attacker to obtain a valid agent ID and encryption key. With these credentials, the attacker connects to `remoted` (port 1514/TCP) using the Wazuh agent protocol (Blowfish-CBC encryption with zlib compression) and injects specially crafted rootcheck events (message type <code>ROOTCHECK_MQ = '9'</code>) containing key-value pairs longer than 30 bytes.
When these events match built-in rootcheck rules (IDs 509–520), the JSON output path is triggered, calling the vulnerable `W_JSON_ParseRootcheck` function. The heap overflow corrupts memory and crashes <code>wazuh-analysisd</code>. Critically, the crash occurs silently—no error is logged, the dashboard and API remain responsive, and administrators see only stale data, completely unaware that alert processing has ceased. This creates a blind spot where active threats go undetected.
The CVSS v3.1 base score is 7.5 (High) with vector <code>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</code>, reflecting the ease of remote exploitation and the significant availability impact. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). Proof-of-concept code exists that implements the full Wazuh agent protocol—enrollment, encryption, compression, and checksums—requiring only network access to a vulnerable Wazuh manager.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: ....... Wazuh Manager
Version: ........ 1.0.0 – 4.14.4
Vulnerability :.. Heap Buffer Overflow (CWE-122)
Severity: ....... Critical (CVSS 7.5 HIGH)
date: ........... 2026-07-16
<h2 style="color: blue;">Prediction: ..... Patch expected 2026-07-20</h2>
<h2 style="color: blue;">What Undercode Say: Analytics & Technical Indicators</h2>
<h2 style="color: blue;">Detection Analytics</h2>
<h2 style="color: blue;">| Indicator | Value |</h2>
<h2 style="color: blue;">|--|-|</h2>
<h2 style="color: blue;">| Affected Component | `wazuh-analysisd` |</h2>
<h2 style="color: blue;">| Vulnerable Function | `W_JSON_ParseRootcheck` |</h2>
| Trigger Pattern | Rootcheck events with `{key: value}` > 30 bytes |
| Attack Vector | Remote, unauthenticated, network accessible |
| Default Config Flaw | `<use_password>no</use_password>` in `wazuh_manager.conf` |
| Silent Failure | No alerts, dashboard shows stale data |
<h2 style="color: blue;">Bash Commands to Check Vulnerability</h2>
[bash]
Check Wazuh version
/var/ossec/bin/wazuh-control info
Verify if vulnerable JSON output is enabled
grep -i "jsonout_output" /var/ossec/etc/ossec.conf
Check authd password requirement
grep -A2 "<auth>" /var/ossec/etc/ossec.conf
Monitor wazuh-analysisd process (if crashed, this will show nothing)
ps aux | grep wazuh-analysisd
Check for unexpected agent enrollments (potential attack)
grep "authd" /var/ossec/logs/ossec.log | grep "New agent"
Look for rootcheck events with long key-value patterns
grep "rootcheck" /var/ossec/logs/ossec.log | grep -E "{[A-Za-z0-9_]: [A-Za-z0-9_., ]{30,}}"
Code Snippet of Vulnerable Logic (from Wazuh source)
// src/analysisd/format/json_extended.c (v4.14.4)
define MAX_STRING_LESS 30 // line 103 — 30-byte allocation
// Allocate heap buffer
results[bash] = malloc((MAX_STRING_LESS) sizeof(char)); // line 116
// Regex matching {key: value} patterns
regex_text = "\{([A-Za-z0-9_]: [A-Za-z0-9_., ])\}"; // line 631
// Unbounded write — overflow if captured content > 30 bytes
sprintf(results[bash], "%.s", (finish - start), to_match + start);
Exploit: Attack Chain in Detail
1. Enrollment (Unauthenticated)
Attacker connects to `authd` on port 1515/TLS. Due to default <use_password>no</use_password>, no password is required. The server responds with a valid agent ID and a Blowfish-CBC encryption key.
2. Connection Establishment
Using the obtained key, the attacker connects to `remoted` on port 1514/TCP. The Wazuh agent protocol is used with Blowfish-CBC encryption and zlib compression. Messages include MD5 checksums for integrity.
3. Rootcheck Event Injection
The attacker sends a `ROOTCHECK_MQ` message (type '9') containing a rootcheck event with a key-value pattern exceeding 30 bytes, for example:
`{CIS: 1.1.2 RHEL7 VeryLongStringThatExceedsThirtyBytes}`
4. Heap Overflow & Crash
The event matches rootcheck rules (509–520), triggering JSON output. `W_JSON_ParseRootcheck` extracts the pattern and calls `sprintf` to write it into the 30-byte heap buffer. The overflow corrupts adjacent heap metadata, causing `wazuh-analysisd` to crash immediately.
5. Silent Denial of Service
The crash is not logged. The dashboard and API remain online, displaying stale data. All SIEM alert processing stops until the service is manually restarted or the system is patched.
Protection: Mitigation Strategies
| Priority | Action | Details |
|-|--||
| 1. Immediate Patching | Upgrade to Wazuh v4.14.5 or later | The fix enforces proper buffer size validation in W_JSON_ParseRootcheck, eliminating the overflow condition. |
| 2. Enforce Authentication | Set `
| 3. Network Segmentation | Restrict access to ports 1514 and 1515 to trusted networks only | Use firewalls or ACLs to limit exposure of the Wazuh manager to authorized agents. |
| 4. Disable JSON Output (Temporary) | Set `
| 5. Monitor for Anomalies | Alert on unusual agent enrollments or rootcheck events with abnormally long key-value pairs | Use log monitoring (e.g., ossec.log) to detect potential exploitation attempts. |
| 6. Restart After Patching | Restart the Wazuh manager service after applying updates | Ensures the patched binaries are loaded and running. |
Impact: Consequences of Exploitation
- Complete Loss of SIEM Alert Processing – `wazuh-analysisd` crashes, stopping all threat detection, event correlation, and alert generation.
- Silent Failure – No error notifications are generated; administrators remain unaware while the dashboard and API display outdated information.
- Extended Dwell Time – Attackers can operate undetected for prolonged periods, as no new alerts are produced to indicate malicious activity.
- Operational Disruption – Security operations teams lose visibility into their environment, potentially missing active breaches or policy violations.
- Resource Exhaustion – Repeated exploitation can lead to continuous crashes, requiring manual intervention to restart the service and restore monitoring.
- Compliance & Reporting Gaps – Organizations relying on Wazuh for compliance logging may fail to meet reporting requirements due to missing alert data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
