CVE-2026-74045: Heap-based Buffer Overflow in Wazuh wazuh-manager

Wazuh wazuh-manager versions >=3.12.0 and <4.14.8 contain a heap buffer overflow vulnerability in the fim_generate_alert() function. The vulnerability arises because the buffer full_log is sized according to input but written with a size limited by OS_MAXSTR, allowing an enrolled agent to send a specially crafted FIM syscheck event that corrupts heap memory. This corruption causes the wazuh-analysisd process to crash deterministically, leading to a disruption in detection capabilities across the managed fleet.

Exploitation of this vulnerability allows an enrolled agent to cause a heap memory corruption in the wazuh-manager, resulting in a deterministic crash of the wazuh-analysisd process. This crash leads to a fleet-wide detection outage, impairing the security monitoring and alerting capabilities of the Wazuh deployment. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict enrollment of untrusted agents and monitor for unusual FIM syscheck events to reduce risk.