CVE-2026-112335— Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull

Quick assessment

Affected

wazuh wazuh

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wazuh 代理（版本 1.0.0 至 4.14.9 之前）在 logcollector 模块的 Snort-full 日志读取器中存在一个基于栈的缓冲区溢出漏洞。该漏洞源于函数错误计算了剩余缓冲区空间。攻击者若向受监控的 Snort-full 日志写入精心构造的多行内容，即可溢出一个大小为 65,280 字节的栈缓冲区，导致代理崩溃；在 32 位 Windows 系统上，若代理以 SYSTEM 权限运行，攻击者还可能覆盖结构化异常处理（SEH）处理器。

CVSS 5.5 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull

Source: CVE Program / CVE List V5

Vulnerability Description

Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

栈缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wazuh	wazuh	1.0.0 ~ 4.14.9	-

II. Public POCs for CVE-2026-112335

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112335

请登录查看更多情报信息。

Other References for CVE-2026-112335 (3)

https://github.com/wazuh/wazuh/releases/tag/v4.14.9 release-notes
https://github.com/wazuh/wazuh/security/advisories/GHSA-3gq8-gg8f-5h8h vendor-advisory
https://www.vulncheck.com/advisories/wazuh-agent-1.0.0-before-4.14.9-stack-buffer-overflow-via-read-snortfull third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-112335

Same Patch Batch · wazuh · 2026-11-06 · 8 CVEs total

CVE-2026-112340	8.2 HIGH	Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request
CVE-2026-112336	6.5 MEDIUM	Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder
CVE-2026-112341	6.5 MEDIUM	Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
CVE-2026-112338	5.9 MEDIUM	Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination
CVE-2026-112339	5.9 MEDIUM	Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module
CVE-2026-112334	4.9 MEDIUM	Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
CVE-2026-112337	3.7 LOW	Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination

IV. Related Vulnerabilities

Same product: wazuh

Same vendor: wazuh

Same weakness: CWE-121