Alimezar

A heap out-of-bounds write occurs when processing a specially crafted font. The issue resides in the `RenderSDF()` function (include/mapbox/glyph foundry impl.hpp), where the SDF (signed distance fields) bitmap allocation size is calculated as `buffered width` * `buffered height` using a 32-bit unsigned integer. Because glyph dimensions are derived from the font's outline bounding box without an upper bound, a sufficiently large glyph can cause the calculation to exceed 2³², resulting in an integer wrap-around to a small value. This leads to an under-allocated buffer, while the render loop continues to write one byte per pixel, causing heap corruption and process crashes.

A blind Server-Side Request Forgery (SSRF) exists when the `[oauth2 client] UPDATE AVATAR = true` setting is enabled. The issue occurs because the server fetches the avatar URL provided by an OAuth2/OIDC provider—typically the `picture` claim—using the default Go HTTP client without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim can force the Gitea server to make arbitrary outbound HTTP GET requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`. Technical details include: - **Vulnerable Function**: `oauth2UpdateAvatarIfNeed()` in `routers/web/auth/oauth.go` and `oauth2SignInSync()` in `routers/web/auth/oauth signin sync.go`. - **Vulnerable Variable**: `gothUser.AvatarURL`. While the issue is primarily blind because non-image responses are rejected, the impact increases if the server can reach cloud metadata services or internal services that return valid image data, which could then be stored as the user's avatar.

Wazuh server API brute-force protection for the 'POST /security/user/authenticate' endpoint can be bypassed by sending concurrent authentication requests. While the `max login attempts` threshold is correctly enforced for sequential requests, a parallel burst allows more failed login attempts to be processed before an IP block is applied, enabling more password guesses than the configured policy intends.

A stack-based buffer overflow exists in the `print hex string()` function within wazuh-remoted. This occurs when formatting attacker-controlled bytes using `sprintf()` on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For instance, input bytes such as 0xFF may result in the emission of "ffffffff" instead of "ff", leading to an out-of-bounds write past a fixed 2049-byte stack buffer. This path is reachable remotely via TCP/1514 before agent authentication or registration when an oversized length prefix triggers the "unexpected message (hex)" diagnostic path. Additionally, this same unauthenticated path allows for remote log amplification by logging attacker-controlled hex dumps to `/var/ossec/logs/ossec.log`, which can consume disk/IO resources and degrade monitoring fidelity.

A path traversal issue exists in the cluster synchronization extraction routine, specifically within the `decompress files()` function. This allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. The flaw can be escalated to remote code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components. In environments where the cluster daemon operates with elevated privileges, a full system-level compromise is possible. Over 3,500 unpatched instances were identified as of 2026-05-10.

The `safe join` function in Werkzeug, a WSGI web application library, improperly handles Windows device names when used as filenames, particularly when preceded by other path segments. Specifically, the function allows Windows device names as filenames, potentially leading to indefinite hanging when reading files if the application is running on Windows and the requested path ends with a special device name. The `send from directory` function utilizes `safe join` to serve files, making it susceptible to this issue.