CVE-2026-74045

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.12.0 through 4.14.7

Description A heap buffer overflow exists in the fim generate alert() function. The issue occurs because the full log variable is sized based on input but written with a boundary defined by OS MAXSTR. An enrolled agent can exploit this by sending a specially crafted FIM syscheck event to corrupt the manager heap memory, leading to a deterministic crash of the wazuh-analysisd process and resulting in a fleet-wide detection outage.

Recommendations Update to version 4.14.8 or later.