CVE-2026-44251: 
Wazuh Server vulnerability analysis and mitigation

CVE-2026-44251 is a size_t integer underflow vulnerability in Wazuh's os_crypto/shared/msgs.c (line 389) that allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents. A secondary code path triggered by the same underflow may enable heap memory corruption and potential remote code execution. Affected versions span Wazuh 3.0.0 through 4.14.4; the issue is fixed in version 4.14.5. It carries a CVSS v3.1 base score of 6.5 (Medium) (Wazuh Advisory).

The root cause is a missing minimum-length guard in the ReadSecMSG function in os_crypto/shared/msgs.c. After decompression via os_zlib_uncompress, the function unconditionally advances the pointer f_msg by 53 bytes (32 checksum + 5 random + 10 global counter + 1 colon + 4 local counter + 1 colon) and then computes *final_size -= (f_msg - buffer). If the decompressed output is fewer than 53 bytes, this subtraction wraps around as an unsigned size_t to approximately SIZE_MAX (CWE-191). The inflated msg_length is then passed to os_calloc, which calls merror_exit() on a NULL return, terminating wazuh-remoted (Finding 1). A second code path in remoted/manager.c:269 propagates the corrupted msg_length to req_update, where malloc(0) on Linux may return a non-NULL pointer followed by a memcpy of SIZE_MAX bytes, causing heap corruption (CWE-122, Finding 2). Exploitation requires only a valid enrolled agent ID and encryption key — no cluster key is needed (Wazuh Advisory).

The primary impact is a complete Denial of Service: crashing wazuh-remoted immediately disconnects all enrolled agents from the manager, blinding the entire monitored infrastructure to threats. The secondary impact is potential heap memory corruption in remoted/manager.c that, depending on malloc(0) behavior and runtime memory layout, could enable remote code execution as the wazuh user. Any compromised or malicious enrolled endpoint can trigger this condition, making the blast radius organization-wide for all assets monitored by the affected Wazuh manager (Wazuh Advisory).

1. Prerequisite: Obtain a valid enrolled Wazuh agent ID and its corresponding encryption (Blowfish) key — no cluster key is required.
2. Craft the decompressed payload: Construct a 32-byte payload consisting of the fixed MD5 constant d41d8cd98f00b204e9800998ecf8427e (the MD5 of zero bytes). This ensures CheckSum validation passes unconditionally.
3. Engineer ciphertext bytes: Using the agent's known Blowfish key, perform at most 256 Blowfish operations to engineer the ciphertext such that buffer[47] contains a colon character and buffer[53-55] passes IsValidHeader checks. Alternatively, use a 48–52 byte compressed payload where the colon is embedded directly in the decompressed data.
4. Compress the payload: Apply zlib compression to the crafted 32-byte decompressed payload to produce a compressed message of 1–52 bytes.
5. Send the crafted message: Transmit the compressed agent message to the Wazuh manager's wazuh-remoted listener using the enrolled agent's credentials.
6. Trigger the underflow: ReadSecMSG decompresses the payload, finds *final_size < 53, and the subtraction wraps size_t to ~SIZE_MAX.
7. Achieve DoS: os_calloc(SIZE_MAX, ...) returns NULL, triggering merror_exit(), which terminates wazuh-remoted and disconnects all agents from the manager.
8. (Optional) Attempt heap corruption: Craft the message to match the HC_REQUEST prefix, causing the corrupted msg_length to propagate to req_update in remoted/manager.c:269, potentially triggering a heap overflow via memcpy(SIZE_MAX) if malloc(0) returns non-NULL (Wazuh Advisory).

• Logs: Sudden merror_exit or MEM_ERROR entries in /var/ossec/logs/ossec.log from the wazuh-remoted process; log entries showing wazuh-remoted process termination or restart.
• Process: Unexpected termination or restart of the wazuh-remoted daemon on the Wazuh manager; all agent connections dropping simultaneously.
• Network: Compressed agent messages arriving at the manager's remoted port (default UDP/TCP 1514) with decompressed payloads shorter than 53 bytes; repeated connection attempts from a single agent ID in a short timeframe.
• System: Core dump files generated by wazuh-remoted in /var/ossec/ or system core dump directories; wazuh-remoted process respawning repeatedly in a short window (Wazuh Advisory).

Upgrade Wazuh to version 4.14.5 or later, which adds a minimum-length guard (MSG_OVERHEAD = 53) in msgs.c immediately after os_zlib_uncompress to return KS_CORRUPT for short messages. As a compensating control, restrict agent enrollment to trusted, known systems only to reduce the attack surface. Monitor for unexpected wazuh-remoted crashes and mass agent disconnections as indicators of exploitation attempts (Wazuh Advisory).