CVE-2026-40106: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-40106 is a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows, affecting versions 4.6.0 through 4.14.4. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed 256-byte heap buffer (OS_SIZE_256); a low-privileged local attacker can create a registry subkey with a maximum-length name (255 characters) inside a monitored path to trigger an out-of-bounds write during string concatenation. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, this can result in a silent Denial of Service or potentially Local Privilege Escalation (LPE). The vulnerability was published on July 17, 2026, and patched in version 4.14.5. NVD assigns a CVSS v3.1 base score of 7.8 (High), while the GitHub advisory rates it 4.7 (Moderate) with higher attack complexity (GitHub Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in syscheck_op.c within the w_expand_by_wildcard function, present in both the ? and * wildcard evaluation branches. The code allocates a fixed 256-byte buffer via os_calloc(OS_SIZE_256, sizeof(char), full_path) and then uses unsafe strcpy/strcat calls to concatenate the base path (first_part), the matching subkey name (*query_keys), and any remaining path (second_part) without bounds checking. Since the Windows API permits registry subkey names up to 255 characters, a base path of even 32 bytes combined with a 255-character subkey name yields 287 bytes — well beyond the 256-byte boundary — corrupting adjacent heap metadata (LFH/Backend allocator). The attack vector is local, requires low privileges, and no user interaction, with low attack complexity per NVD scoring (GitHub Advisory).

Successful exploitation can cause the wazuh-agent.exe process to crash with a STATUS_HEAP_CORRUPTION (0xC0000374) exception, effectively blinding the EDR/SIEM agent to malicious activity on the endpoint (Denial of Service). A sophisticated attacker employing Heap Feng Shui techniques could potentially manipulate the heap layout to overwrite adjacent object pointers and achieve arbitrary code execution as NT AUTHORITY\SYSTEM, constituting a full Local Privilege Escalation. The confidentiality, integrity, and availability impacts are all rated High under NVD's scoring, reflecting the potential for complete system compromise (GitHub Advisory).

1. Reconnaissance: Identify a Windows host running Wazuh agent versions 4.6.0–4.14.4 where the attacker has low-privileged local access and the agent's ossec.conf is configured to monitor a registry wildcard path accessible to standard users (e.g., HKEY_CURRENT_USER\Software\*).
2. Configure monitored path (if attacker has influence): Confirm or social-engineer an administrator to add a wildcard registry path under HKEY_CURRENT_USER in ossec.conf, such as <registry>HKEY_CURRENT_USER\Software\WazuhTest\*</registry>, so the syscheck component will enumerate subkeys under that path.
3. Create malicious registry subkey: As a standard (low-privileged) user, open PowerShell and execute: New-Item -Path "HKCU:\Software\WazuhTest\$('A'*255)" -Force to create a subkey with a 255-character name inside the monitored wildcard path.
4. Trigger syscheck scan: Wait for the Wazuh syscheck thread to perform its scheduled registry scan (or trigger a manual scan if possible). The w_expand_by_wildcard function will attempt to concatenate the base path and the 255-character subkey name into the 256-byte buffer.
5. Achieve DoS or LPE: The strcat operation writes beyond the allocated heap buffer, corrupting adjacent heap metadata. The wazuh-agent.exe process crashes with STATUS_HEAP_CORRUPTION (DoS). A sophisticated attacker could use Heap Feng Shui to control the heap layout and redirect execution to attacker-controlled code running as NT AUTHORITY\SYSTEM (LPE) (GitHub Advisory).

• Process: wazuh-agent.exe crashing unexpectedly with exception code STATUS_HEAP_CORRUPTION (0xC0000374); Windows Error Reporting (WER) generating crash dumps for wazuh-agent.exe.
• Registry: Presence of a registry subkey under a Wazuh-monitored wildcard path (e.g., HKEY_CURRENT_USER\Software\WazuhTest\) with a name consisting of 255 repeated characters (e.g., 255 × 'A').
• Logs: Windows Application Event Log entries showing wazuh-agent.exe process termination or fault bucket entries referencing heap corruption; absence of expected Wazuh syscheck log entries following a crash (agent goes silent).
• File System: Windows crash dump files (.dmp) in %LOCALAPPDATA%\CrashDumps or %WINDIR%\Minidump associated with wazuh-agent.exe (GitHub Advisory).

Wazuh has released version 4.14.5, which fixes the buffer overflow by properly handling registry path expansion with wildcards; all users running versions 4.6.0 through 4.14.4 should upgrade immediately. As a temporary workaround where upgrading is not immediately possible, administrators should avoid configuring wildcard registry monitoring paths (* or ?) under registry hives writable by low-privileged users (e.g., HKEY_CURRENT_USER), or restrict write access to monitored registry paths. Organizations in environments where unprivileged users have write access to monitored registry paths should treat this as a high-priority update (GitHub Advisory).

The vulnerability was discovered by security researcher bytecodesky (finder) and analyzed by hwpark6804-gif and Darioortegaleyva, with remediation developed by the Wazuh team and published via GitHub Security Advisory on July 16, 2026. No significant broader media coverage or notable social media commentary beyond the official advisory has been identified at this time (GitHub Advisory).