CVE-2026-112334

Name of the Vulnerable Software and Affected Versions Wazuh versions 1.0.0 through 4.14.8

Description An out-of-bounds write issue exists in the wazuh-execd component. Privileged attackers with access to the manager configuration can corrupt root process memory by providing excessive ar.conf entries. Specifically, by controlling the active-response blocks in ossec.conf, an attacker can send more than 64 commands to agents, which overflows the arrays in the ReadExecConfig() function and causes a fleet-wide crash of the Active Response system.

Recommendations Update to version 4.14.9 or later.