CVE-2026-74045 is a heap buffer overflow (CWE-122) in the file integrity monitoring decoder of Wazuh. An enrolled agent can send a crafted event that crashes wazuh-analysisd on the manager. The record rates it High at 7.1. Version 4.14.8 fixes it.
What's affected
The record says Wazuh from 3.12.0 before 4.14.8 is affected, and the advisory (GHSA-gc4j-j9fg-4cfr) lists 4.14.8 as patched. The manager is the component at risk.
The attacker needs to be an enrolled agent, which is why the record asks for low privileges. The advisory is careful about scope: it demonstrates an out-of-bounds write, corruption of adjacent heap data and a deterministic crash, and it says plainly that control flow hijack was not developed and that the report does not claim remote code execution.
The record and VulnCheck agree here: 7.1 (High) under CVSS 3.1 in the record, and 7.1 (High) under CVSS 4.0 at VulnCheck, with the impact on integrity low and on availability high.
How to check if you're exposed
Find the version on each manager and, where relevant, each agent.
/var/ossec/bin/wazuh-control info
The output includes the version. Packages installed from repositories can also be checked with your package manager, for example rpm -q wazuh-manager or dpkg -l wazuh-manager. Compare with 4.14.8, the fixed version the advisory lists.
What to do now
- Upgrade Wazuh managers to 4.14.8 or later, and then agents as part of normal maintenance.
- Monitor wazuh-analysisd. Alert if it restarts or exits, because detection stops while it is down.
- Review enrollment: who can register an agent, and is registration protected by a password or other control?
- Remove agents that no longer exist, so an old credential cannot be reused.
- Test your response plan for a detection blind spot. What would you do if the manager analysis engine were offline for an hour?
Why it matters
The weakness is a heap based buffer overflow, CWE-122. According to the advisory, a field called full_log is allocated according to the length of the input, then written up to an unrelated fixed limit. When the written data exceeds the allocation, adjacent heap memory is overwritten.
The practical consequence is an outage of detection. The component that applies rules to every event from every agent, running as root, terminates. An attacker who wants to act without being noticed benefits from a crash they can trigger on demand. Defenders should therefore care about availability of security tooling as much as about its confidentiality. KEV status is false.
Quick check
Does this give remote code execution?
The advisory says it does not claim that. It demonstrates memory corruption and a crash. Treat the crash as the proven impact.
What is the quickest mitigation besides the upgrade?
Control who can enroll agents, and alert on analysisd restarts. Neither replaces the fix.
Sources
Last reviewed: 18 October 2026.
