CVE-2026-25772

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.14.3, a stack-based buffer overflow vulnerability exists in the Wazuh Database synchronization module (`wdb_delta_event.c`). The SQL query construction logic allows for an integer underflow when calculating the remaining buffer size. This occurs because the code incorrectly aggregates the return value of `snprintf`. If a specific database synchronization payload exceeds the size of the query buffer (2048 bytes), the size calculation wraps around to a massive integer, effectively removing bounds checking for subsequent writes. This allows an attacker to corrupt the stack, leading to a Denial of Service (DoS) or potentially RCE. Version 4.14.3 fixes the issue.

• CWE-121
• CWE-191

• https://github.com/wazuh/wazuh/security/advisories/GHSA-h7vp-j34v-h6j5Exploit, Mitigation, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25767LavinMQ is a high-performance message queue & streaming serv…8.1
• CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
• CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-2577The WhatsApp bridge component in Nanobot binds the WebSocket…10
• CVE-2026-25770Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-25771Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-25773** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails…6.5
• CVE-2026-25774Charging station authentication identifiers are publicly acc…5.3
• CVE-2026-25775A vulnerability in SenseLive X3050’s remote management servi…9.8
• CVE-2026-25776Movable Type provided by Six Apart Ltd. contains a code inje…9.8
• CVE-2026-25778The WebSocket backend uses charging station identifiers to u…7.5
• CVE-2026-25779Gitea versions up to and including 1.25.4 allow redirect byp…6.1