CVE-2026-112334

CVSS 6.9 (medium) · published 2026-11-06

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.

Weakness: CWE-787

Source: NVD CVE-2026-112334

References

• https://github.com/wazuh/wazuh/releases/tag/v4.14.9
• https://github.com/wazuh/wazuh/security/advisories/GHSA-f4pj-j296-jwp2
• https://www.vulncheck.com/advisories/wazuh-1.0.0-before-4.14.9-out-of-bounds-write-in-wazuh-execd-via-ar-conf
• https://github.com/wazuh/wazuh/security/advisories/GHSA-f4pj-j296-jwp2

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.