Medium severity4.9NVD Advisory· Published Nov 6, 2026

CVE-2026-112334

Description

Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-configuration attackers to corrupt root process memory via excess ar.conf entries. Attackers controlling ossec.conf active-response blocks can push over 64 commands to agents, overflowing ReadExecConfig() arrays and crashing Active Response fleet-wide.

Affected products

Wazuh/wazuh-execdllm-create
Range: <4.14.9
Wazuh/Wazuhllm-fuzzy
Range: <4.14.9

Patches

Vulnerability mechanics

References

github.com/wazuh/wazuh/releases/tag/v4.14.9nvd
github.com/wazuh/wazuh/security/advisories/GHSA-f4pj-j296-jwp2nvd
www.vulncheck.com/advisories/wazuh-1.0.0-before-4.14.9-out-of-bounds-write-in-wazuh-execd-via-ar-confnvd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000