CVE-2026-41499: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-41499 describes multiple heap-based out-of-bounds write (buffer underflow) vulnerabilities in the parse_uname_string() function within src/shared/remoted_op.c of the Wazuh security platform. The flaw affects Wazuh versions 4.0.0 through 4.14.3 (wazuh-manager package) and was published on April 29, 2026, with a patch released in version 4.14.4. It carries a CVSS v3.1 base score of 6.5 (Medium), reflecting network-accessible exploitation requiring low privileges but resulting only in availability impact (GitHub Advisory).

The root cause is a combination of CWE-191 (Integer Underflow) and CWE-124 (Buffer Underwrite): the function writes \0 to ptr + strlen(ptr) - 1 without first checking whether the string is empty. When strlen() returns 0 for an empty string, the subtraction 0 - 1 wraps to SIZE_MAX (18446744073709551615 on 64-bit systems) due to unsigned integer underflow. Pointer arithmetic then wraps the address to ptr - 1, causing a single null-byte write one byte before the allocated heap buffer — corrupting glibc malloc metadata such as the chunk size or PREV_INUSE bit. The flaw appears at four locations in the same function (lines 93, 138, 145, and 168), all reachable via the call chain HandleSecureMessage → parse_json_keepalive → parse_uname_string() when processing agent keep-alive messages. A proof-of-concept standalone C program simulating a malicious agent sending crafted encrypted keep-alive messages is included in the advisory (GitHub Advisory).

Successful exploitation primarily causes a denial of service by crashing wazuh-remoted or wazuh-analysisd through heap corruption, disrupting the Wazuh manager's ability to receive and process agent data. In more advanced scenarios, the single null-byte write at a fixed -1 offset could corrupt heap metadata (e.g., clearing the PREV_INUSE bit in glibc malloc), potentially enabling further heap exploitation on subsequent allocations — though this is considered difficult due to the constrained write primitive. Confidentiality and integrity are not directly impacted per the CVSS scoring, but loss of the Wazuh manager's availability could blind security operations to ongoing threats (GitHub Advisory).

A PoC is publicly documented in the GitHub Security Advisory, including a standalone C program (poc_malicious_agent_standalone.c) that simulates a compromised Wazuh agent sending malformed encrypted keep-alive messages over TCP or UDP to trigger the vulnerability. Exploitation requires low privileges (a registered agent credential or the ability to perform a man-in-the-middle attack on agent-manager communication). There is no evidence of in-the-wild exploitation, no CISA KEV listing, and the EPSS score is approximately 0.04% — indicating low current exploitation probability (GitHub Advisory).

1. Obtain agent credentials: Acquire a valid Wazuh agent ID, name, and shared key from client.keys (e.g., via a compromised agent host or MITM position on the agent-manager communication channel).
2. Craft malicious uname payload: Construct a JSON keep-alive message with a malformed uname field targeting one of the four vulnerable patterns, for example:
   • Instance 1 (line 138): Linux |host | [TestOS|linux: — empty os_version after :
   • Instance 2 (line 145): Linux |host | [TestOS|linux: 1.0 (] — empty os_codename after (
   • Instance 3 (line 168): Linux |host | [ — empty os_name with no : separator
3. Encrypt and frame the message: Use the Wazuh agent encryption protocol (AES with the shared key) to encrypt the malicious keep-alive message, matching the expected wire format for wazuh-remoted.
4. Send to the manager: Transmit the crafted encrypted packet to the Wazuh manager's remote port (default TCP/UDP 1514) using the registered agent credentials.
5. Trigger heap corruption: The manager's wazuh-remoted process calls parse_json_keepalive → parse_uname_string(), which performs the underflowing write, corrupting heap metadata and crashing the process (DoS) or potentially enabling further heap exploitation (GitHub Advisory).

• Network: Unusual or repeated connections to the Wazuh manager on port 1514 (TCP/UDP) from unexpected source IPs or from agents sending abnormally structured keep-alive messages; traffic patterns inconsistent with normal agent heartbeat intervals.
• Logs: Crash logs or core dumps from wazuh-remoted or wazuh-analysisd; ASAN output in /tmp/remoted_asan.log referencing heap-buffer-overflow in parse_uname_string at remoted_op.c:138, :145, :168, or :93; unexpected process restarts of wazuh-remoted.
• Process: wazuh-remoted or wazuh-analysisd terminating unexpectedly with segmentation faults or heap corruption errors; repeated process respawns by the Wazuh manager watchdog.
• File System: Unexpected core dump files in the Wazuh working directory (e.g., /var/ossec/) following manager crashes (GitHub Advisory).

Wazuh has released version 4.14.4, which patches all four vulnerable instances in parse_uname_string() by adding a strlen() length check before each subtraction operation (e.g., size_t len = strlen(str); if (len > 0) { str[len - 1] = '\0'; }). All users running Wazuh manager versions 4.0.0 through 4.14.3 should upgrade to 4.14.4 immediately. No official configuration-based workaround is provided; network-level controls restricting access to port 1514 to known, trusted agent IPs can reduce exposure but do not eliminate the risk from compromised agents (GitHub Advisory, Wazuh v4.14.4 Release).

The vulnerability was reported by security researcher marius-momeu and published by Wazuh maintainer vikman90 via GitHub Security Advisory on April 28, 2026. The advisory was rated "Moderate" severity by Wazuh, consistent with the CVSS 6.5 score. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (GitHub Advisory).