CVE-2026-25790: 
Wazuh Agent vulnerability analysis and mitigation

CVE-2026-25790 is a stack-based buffer overflow vulnerability in Wazuh's Security Configuration Assessment (SCA) decoder (wazuh-analysisd). It affects Wazuh versions 3.9.0 through 4.14.2, and was disclosed on March 17, 2026, with a patch released in version 4.14.3. The flaw allows a remote, high-privileged attacker to send a specially crafted JSON event that triggers a stack overflow, potentially causing a denial of service or remote code execution on the Wazuh manager. The CVSS v3.1 base score is 7.2 (High) per Feedly threat intelligence, though the GitHub advisory rates it 4.9 (Moderate) based on a narrower impact scope (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), rooted in the use of an unbounded sprintf call with the %lf format specifier in /src/analysisd/decoders/security_configuration_assessment.c. Within the FillScanInfo and FillCheckEventInfo functions, a 128-byte stack buffer (char value[OS_SIZE_128];) is used to store string representations of numeric fields (e.g., pass, failed, invalid, total_checks, score, scan_id) parsed from incoming JSON events. When a field contains a floating-point value with a large exponent (e.g., 1.0e150), sprintf(value, "%lf", ...) attempts to write a string of over 150 characters — far exceeding the 128-byte buffer — corrupting the stack. Exploitation requires the attacker to be authenticated with high privileges and able to submit JSON events to the analysisd component (GitHub Advisory).

Successful exploitation can cause the wazuh-analysisd process to crash, resulting in a denial of service for the Wazuh manager's event analysis pipeline. In a worst-case scenario, an attacker could achieve remote code execution with the privileges of the Wazuh manager process, potentially gaining full control of the security monitoring infrastructure. Given that Wazuh managers typically have broad visibility into monitored endpoints, a compromised manager could be leveraged for lateral movement or to suppress security alerts across the environment (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Wazuh manager instance running a vulnerable version (3.9.0 to 4.14.2) and obtain high-privileged credentials or API access to submit SCA events to the wazuh-analysisd component.
2. Craft malicious JSON event: Construct a JSON SCA event payload where a numeric field (e.g., pass, failed, score, or scan_id) contains a floating-point value with a large exponent, such as 1.0e150.
3. Submit the payload: Send the crafted JSON event to the Wazuh manager via the appropriate agent or API channel that feeds data into the analysisd SCA decoder.
4. Trigger the overflow: The FillScanInfo or FillCheckEventInfo function processes the double value and calls sprintf(value, "%lf", 1.0e150), attempting to write ~152 characters into the 128-byte stack buffer, overflowing it.
5. Achieve DoS or RCE: The stack corruption causes analysisd to crash (DoS), or with a carefully crafted payload, an attacker may redirect execution flow to achieve arbitrary code execution with Wazuh manager process privileges (GitHub Advisory).

• Logs: Unexpected crashes or restarts of the wazuh-analysisd process in Wazuh manager logs (/var/ossec/logs/ossec.log); segmentation fault or abort signals associated with the analysisd process.
• Network: Unusual or repeated SCA JSON event submissions from a single agent or IP address containing floating-point values with large exponents in fields like pass, failed, score, invalid, total_checks, or scan_id.
• Process: Abnormal termination of wazuh-analysisd (e.g., exit code indicating signal 6/SIGABRT or signal 11/SIGSEGV); unexpected child processes spawned by the Wazuh manager process.
• File System: Core dump files generated in the Wazuh installation directory following analysisd crashes (GitHub Advisory).

Upgrade Wazuh to version 4.14.3 or later, which replaces all vulnerable sprintf calls with bounded snprintf(value, sizeof(value), "%lf", ...) equivalents. For environments unable to patch immediately, implement network-level access controls to restrict which agents and systems can submit JSON events to the analysisd component, and monitor incoming SCA events for anomalous floating-point values with large exponents. Enforcing strict authentication and least-privilege access for Wazuh API and agent connections reduces the attack surface (GitHub Advisory).

The vulnerability was reported by security researcher skraft9 and published by Wazuh maintainer vikman90 via GitHub's security advisory process on March 17, 2026. Red Hat has acknowledged the CVE in their security tracking portal. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory, Red Hat CVE).