CVE-2026-74045

Executive Summary

CVE-2026-74045 is a heap buffer overflow in Wazuh's File Integrity Monitoring (FIM) alerting path, specifically within the fim_generate_alert() function, affecting versions from 3.12.0 up to (but excluding) 4.14.8. An enrolled Wazuh agent can send a crafted FIM syscheck event that triggers a size mismatch: full_log is allocated based on the input length, but the write operation is bounded by the fixed constant OS_MAXSTR, allowing an out-of-bounds heap write. Exploitation requires only an authenticated/enrolled agent role (CVSS PR:L) and results in deterministic corruption of the Wazuh Manager's heap within wazuh-analysisd, leading to a crash and a fleet-wide detection outage.

Technical Analysis

The vulnerability is a classic CWE-122 heap-based buffer overflow arising from an allocation-versus-write size mismatch. According to the NVD description, the fim_generate_alert() function allocates the full_log buffer sized from input (i.e., dynamically derived from the length of data supplied in the incoming syscheck event), but the subsequent write into that buffer is bounded by the compile-time constant OS_MAXSTR. When the input-derived sizing is smaller than what the OS_MAXSTR-bounded write requires, the copy operation writes past the end of the allocated region.

Two conditions underpin the flaw:

1. Inconsistent bounds. The allocation decision and the copy decision are governed by different limits. A safe implementation would use a single, consistent bound (min(allocated_size, OS_MAXSTR)) for both allocation and copy. Here they diverge.
2. Untrusted length input. The full_log size is derived from the agent-supplied syscheck event. Because a Wazuh agent is a logical trust boundary that accepts remote configuration and event data, an enrolled agent can influence this length directly.

The vulnerable component sits inside wazuh-analysisd, the Wazuh Manager daemon responsible for parsing, decoding, and correlating events received from agents. Because fim_generate_alert() is invoked along the FIM/syscheck alert-generation path, any crafted syscheck event that traverses this code path with a malicious length field can trigger the overflow.

Impact mechanics: a heap overflow in a long-running daemon such as wazuh-analysisd can corrupt adjacent heap metadata or application structures. The NVD description explicitly characterizes the outcome as a deterministic crash of wazuh-analysisd, meaning the corruption reliably terminates the analysis daemon rather than merely producing undefined behavior. Because wazuh-analysisd is the central event-processing engine for the manager, its termination halts event ingestion, decoding, rule evaluation, and alert generation across the entire monitored fleet — a single enrolled agent can therefore induce a manager-wide detection blackout.

Notable constraints: CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H indicates network reachability (agent-to-manager channel), low attack complexity, low privileges (enrolled agent), no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. The integrity subscore reflects the possibility of in-daemon heap corruption rather than confirmed privilege escalation or code execution; no public evidence demonstrates remote code execution.

No CVE title was supplied by the CNA, and no affected package enumeration (OSV), workaround, or vendor fix is available in the provided data. All technical claims above are derived strictly from the NVD description text.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (heap buffer overflow via length mismatch). No public PoC is available; the steps below describe the mechanism at the vulnerability-class level and avoid fabricating implementation details not present in the source data.

1. Reconnaissance / target identification. The attacker identifies a Wazuh deployment where they hold, or can obtain, the credentials of an enrolled agent. Because agent enrollment is a normal part of Wazuh operations, this may be achieved through a compromised endpoint running an agent, leaked agent keys, or a low-privilege foothold on a monitored host. The manager's agent listener (transport on the agent channel) is the relevant attack surface.

2. Triggering the flaw. The attacker crafts a FIM syscheck event whose input-derived length causes full_log to be allocated smaller than the OS_MAXSTR-bounded write performed in fim_generate_alert(). The crafted event is transmitted from the enrolled agent to the Wazuh Manager. On receipt, wazuh-analysisd processes the event, reaches fim_generate_alert(), and performs a write that exceeds the allocated full_log region — the heap overflow condition.

3. Payload / execution method. At the vulnerability-class level, the "payload" is the malformed length-bearing syscheck event itself. No shellcode or ROP chain is required to achieve the primary documented impact (crash). Exploitation is a matter of sending the correctly malformed event once; because the overflow is deterministic, no probabilistic heap grooming is needed for the denial-of-service outcome.

4. Post-exploitation impact. The corrupted heap causes wazuh-analysisd to crash. With the analysis daemon down, the manager ceases to process incoming events and generate alerts — an outage that affects all agents reporting to that manager, not just the attacker's. This is a fleet-wide detection outage, meaning security monitoring, FIM alerting, and rule-based detections go dark for the duration. Recovery is likely manual (restart of the daemon), and repeated crafted events can re-trigger the crash, sustaining the outage.

Because no exploit code or PoC is publicly available, no further implementation-level detail can be asserted without speculation. Integrators should assume that any FIM event path that influences full_log sizing is suspect until the vendor's 4.14.8 (or later) remediation is validated.

Impact Assessment

The primary impact is availability (CVSS A:H). A single enrolled agent — the lowest-trust principal in the Wazuh hierarchy — can deterministically crash the central analysis daemon, producing a denial-of-service that cascades to every monitored endpoint on that manager. For organizations relying on Wazuh as their primary SIEM/XDR or FIM platform, this creates a monitored blind spot: alerts stop, correlation stops, and any active intrusions on monitored hosts would go undetected while wazuh-analysisd is down.

The low integrity subscore (I:L) reflects that the overflow can corrupt manager heap memory. While the NVD description stops at "corrupt manager heap memory and deterministically crash," heap corruption in a privileged daemon is an inherently risky primitive; under favorable heap layouts, corrupted structures could theoretically influence control flow. However, no evidence in the provided data supports remote code execution, so confidentiality impact is none (C:N) and code execution should not be assumed.

Blast radius: the manager (and its agent fleet) rather than a single endpoint. In multi-tenant or MSSP deployments, one managed customer's enrolled agent can disrupt the shared manager, affecting other tenants. Combined with low attack complexity (AC:L) and the fact that agent enrollment is a routine operational state, the vulnerability is a high-value availability attack against Wazuh-dependent detection infrastructure. CISA KEV status is No, and there is no indication of active exploitation in the wild.

Detection Guidance

Sigma Rule

title: Wazuh Manager Analysisd Crash via Crafted FIM Syscheck Event (CVE-2026-74045)
id: 8f3c1a2e-7b4d-4e9a-9c6f-2d5e8a1b4c73
status: experimental
description: Detects repeated crashes or abnormal termination of wazuh-analysisd consistent with a crafted FIM syscheck event exploiting the heap overflow in fim_generate_alert().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74045
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_proc:
    message|contains:
      - 'wazuh-analysisd'
  selection_crash:
    message|contains:
      - 'segmentation fault'
      - 'core dumped'
      - 'analysisd: ERROR'
      - 'ossec-analysisd'
  condition: selection_proc and selection_crash
falsepositives:
  - Legitimate daemon restarts or OOM kills
level: high
tags:
  - attack.t1499
  - cve.2026.74045

YARA Rule

rule CVE_2026_74045_Wazuh_FIM_Overflow
{
    meta:
        author = "valtersit.com"
        description = "Detects references to the vulnerable Wazuh FIM alert path (fim_generate_alert / OS_MAXSTR) in binaries or memory, and notes affected version strings."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74045"
        cve = "CVE-2026-74045"

    strings:
        $fim1 = "fim_generate_alert" ascii
        $sym1 = "OS_MAXSTR" ascii
        $ver1 = "wazuh-analysisd" ascii
        $syschk = "syscheck" ascii nocase

    condition:
        (uint16(0) == 0x457f or uint16(0) == 0x5a4d) and
        ($fim1 or ($sym1 and $ver1)) and $syschk
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 1514 (msg:"CVE-2026-74045 Wazuh crafted FIM syscheck event length anomaly (possible heap overflow attempt)"; flow:to_server,established; content:"syscheck"; nocase; content:"fim"; nocase; pcre:"/full_log|OS_MAXSTR/Ri"; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-74045; sid:202674045; rev:1;)

Elastic Detection

sequence by host.name with maxspan=2m
  [ process where process.name == "wazuh-analysisd" ]
  [ process where process.name == "wazuh-analysisd" and process.exit_code != 0 and process.exit_code != 143 ]

Splunk SPL Query

index=os sourcetype=syslog ("wazuh-analysisd" OR "ossec-analysisd")
| search ("segmentation fault" OR "core dumped" OR "heap" OR "abort" OR "crash")
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as messages by host
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="wazuh,">
  <rule id="100945" level="12">
    <decoded_as>syslog</decoded_as>
    <match>wazuh-analysisd|ossec-analysisd</match>
    <regex>segmentation fault|core dumped|heap|abort|crash</regex>
    <description>CVE-2026-74045: possible wazuh-analysisd crash from crafted FIM syscheck event (heap overflow in fim_generate_alert)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_74045,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The version constraint in the NVD description (affected range "before 4.14.8") strongly implies the vendor intends to remediate in version 4.14.8 or later, but no patch, advisory, commit, or workaround is confirmed in the provided data. Treat all Wazuh versions from 3.12.0 up to and including 4.14.7 as vulnerable until a validated fixed release is published.

1. Immediate mitigations.

   • Restrict which agents can connect to the manager's agent listener and enforce strong agent authentication to reduce the population of principals that can reach the vulnerable code path.
   • Monitor wazuh-analysisd health aggressively and configure automatic restart supervision so that any crash is recovered quickly, limiting the detection-outage window.
   • On endpoints, restrict local access to agent configuration and keys so that a compromised host cannot easily originate arbitrary syscheck events.
   • Isolate or segment managers so that a single manager outage does not blind the entire estate; where feasible, run redundant managers or a secondary detection pipeline.
   • In the absence of a vendor fix, consider rate-limiting or filtering anomalous syscheck events at the network layer (see the Suricata rule above) as a compensating control, acknowledging this is not a root-cause fix.

2. Patch / upgrade steps.

   • Track the official Wazuh release channel for a fixed version (expected to be 4.14.8 or later based on the NVD range). Do not rely on version numbers alone — verify against the vendor's release notes and advisory before upgrading.
   • When a fixed release is available, upgrade all manager nodes first, then agents, following the vendor's upgrade procedure. Validate that the fixed build removes the allocation/write mismatch in fim_generate_alert() (allocation and copy must share a single consistent bound).
   • Retain rollback snapshots, and test the upgrade in a staging manager with representative agent traffic before fleet-wide rollout.

3. Long-term hardening.

   • Adopt memory-safe coding practices and pre-merge static analysis (e.g., bounds-checking, fuzzers) targeting buffer allocation/copy pairs so that size derivation is consistent across allocation and write.
   • Maintain an SBOM and asset inventory for the Wazuh manager fleet to shorten time-to-identify when future CVEs land.
   • Subscribe to Wazuh security advisories and CISA/NVD feeds; track EPSS once FIRST.org publishes a score for this CVE.
   • Implement defense-in-depth detection: retain an independent FIM or EDR capability so a single manager crash does not eliminate all monitoring.

References

1. NVD — CVE-2026-74045: https://nvd.nist.gov/vuln/detail/CVE-2026-74045
2. Wazuh official security advisories / release notes (vendor channel for the fixed release): https://wazuh.com/
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
5. CVSS v3.1 Specification (vector interpretation): https://www.first.org/cvss/v3.1/specification-document

Threat actor campaigns / exploit-in-the-wild evidence: None identified. CISA KEV status is No, no public PoC or exploit code is available, and no EPSS score has been published by FIRST.org as of this report.