CVE-2026-25772: 
Wazuh Agent vulnerability analysis and mitigation

CVE-2026-25772 is a stack-based buffer overflow vulnerability in the Wazuh Database synchronization module (wdb_delta_event.c), affecting Wazuh versions 4.4.0 through 4.14.2. The flaw stems from an integer underflow in SQL query construction logic that incorrectly aggregates snprintf return values, allowing stack corruption that can lead to Denial of Service (DoS) or potentially Remote Code Execution (RCE). It was published on March 17, 2026, and patched in version 4.14.3. The CVSS v3.1 base score is 7.2 (High) per NVD, though the GitHub advisory rates it as Moderate (4.9) with a DoS-only scope (GitHub Advisory, Red Hat).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-191 (Integer Underflow/Wraparound), located in src/wazuh_db/wdb_delta_event.c within the wdb_upsert_dbsync and wdb_delete_dbsync functions. These functions build SQL query strings into a fixed 2048-byte stack buffer (query[QUERY_MAX_SIZE]) using a loop that tracks consumed space via query_actual_size += snprintf(...). The critical flaw is that snprintf returns the number of characters that would have been written (not the actual bytes written), so when the buffer fills, query_actual_size exceeds QUERY_MAX_SIZE. In the next iteration, the size argument QUERY_MAX_SIZE - query_actual_size - 1 becomes negative; when implicitly cast to size_t (unsigned), this wraps to a value near 2^64, effectively disabling bounds checking and allowing unbounded writes to the stack. Exploitation requires high privileges (network-authenticated attacker with access to the database synchronization interface) and involves sending a crafted payload exceeding 2048 bytes (GitHub Advisory).

Successful exploitation allows a high-privileged network attacker to corrupt the stack of the Wazuh database synchronization process, resulting in a crash (DoS) or, in a more sophisticated attack, arbitrary code execution on the Wazuh manager host. Given that Wazuh managers are central to security monitoring infrastructure, RCE on this component could allow an attacker to tamper with security event data, disable alerting, or pivot to monitored endpoints. Confidentiality and integrity impacts are rated High under NVD's scoring, while the vendor's advisory focuses primarily on availability impact (GitHub Advisory, Red Hat).

1. Reconnaissance: Identify Wazuh manager instances running versions 4.4.0–4.14.2 exposed on the network. Confirm access to the Wazuh database synchronization interface (typically internal/administrative).
2. Obtain high-privileged credentials: The vulnerability requires high privileges; an attacker must first compromise or possess valid administrative credentials for the Wazuh database synchronization module.
3. Craft oversized synchronization payload: Construct a database synchronization payload that, when processed by wdb_upsert_dbsync or wdb_delete_dbsync, causes the SQL query construction loop to exceed the 2048-byte query buffer. This requires a payload with enough column data to trigger multiple snprintf iterations that collectively overflow query_actual_size beyond QUERY_MAX_SIZE.
4. Trigger integer underflow: Send the crafted payload to the Wazuh manager. The snprintf return value accumulation causes query_actual_size to exceed 2048, making the next size argument negative, which wraps to a massive size_t value.
5. Achieve stack corruption: The subsequent unbounded snprintf write overflows the stack buffer, corrupting adjacent stack memory. This results in a crash (DoS) or, with a carefully crafted payload, control of the instruction pointer for RCE (GitHub Advisory).

• Logs: Unexpected crashes or segmentation faults in Wazuh manager logs (/var/ossec/logs/ossec.log) referencing wdb_delta_event.c or the wazuh-db process; repeated abnormal termination of the wazuh-db daemon.
• Process: Unexpected restarts of the wazuh-db process; child processes spawned by wazuh-db that are not part of normal operation (e.g., shells or network utilities).
• Network: Unusually large or malformed database synchronization messages sent to the Wazuh manager's internal communication socket; unexpected outbound connections from the Wazuh manager host following wazuh-db restarts.
• File System: New or modified files in /var/ossec/ directories created by the wazuh-db process owner outside of normal update windows; presence of poc_snprintf_overflow or similar test binaries on the system.

The primary remediation is to upgrade Wazuh to version 4.14.3 or later, which fixes the incorrect snprintf return value aggregation in wdb_delta_event.c. As a workaround prior to patching, restrict network access to the Wazuh database synchronization module to only trusted administrators, and implement network segmentation to limit which systems can send database synchronization payloads to Wazuh instances. The fix requires checking the snprintf return value against remaining buffer space before updating the accumulator and aborting the loop if truncation is detected (GitHub Advisory).

The vulnerability was reported by researcher skraft9 and published by Wazuh maintainer vikman90 via GitHub's security advisory process on March 17, 2026. Red Hat has tracked the CVE in their security database. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory, Red Hat).