CVE-2026-45798

Wazuh's compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment 'V:' version field into a 10-byte stack buffer using strncpy() without explicitly null-terminating it (CWE-121/CWE-170). An unauthenticated remote attacker who can reach the wazuh-authd enrollment service on TCP port 1515 — reachable before authentication when anonymous TLS enrollment is enabled — can send a version string of at least nine non-null bytes, causing strchr() and strtok() to read past the buffer and strtok() to write a null byte into adjacent stack memory, producing a remote denial of service (CVSS 3.1: 7.5, availability-only impact). Versions from 4.5.0 before 4.14.6 and the 5.0.0 beta line are affected, with fixes shipping in 4.14.6 and 5.0.0-beta2. Exploitation is not observed in the wild (EPSS 0.5%, 41st percentile; not in CISA KEV), though a public vendor advisory with technical details is available.

What to do: Upgrade the Wazuh manager to 4.14.6 or later (or 5.0.0-beta2 or later on the 5.x line). Until patched, restrict TCP 1515 to trusted agent subnets via firewall rules and disable anonymous TLS enrollment in favor of password- or certificate-based enrollment. Review authd logs and crash/coredump history for oversized or malformed version strings in enrollment requests as an indicator of probing.