CVE-2026-112335 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Wazuh agent's logcollector miscalculates buffer space when reading multi-line snort-full logs, causing a stack buffer overflow. An attacker who can write crafted content into a monitored snort-full log can crash the agent or, on 32-bit Windows agents running as SYSTEM, overwrite an SEH handler to potentially run code.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only Wazuh agents from 1.0.0 before 4.14.9 that monitor snort-full log files are exposed. The risk is highest for 32-bit Windows agents running as SYSTEM, where an overwrite could lead to code execution; other agents mainly risk a crash. Hosts that do not run the agent or do not read snort-full logs can skip it.
Not affected if agent-at-or-above-4.14.9, no-snort-full-logs
Who cares linux, snort, wazuh, wazuh-agent, windows
/var/ossec/bin/wazuh-control info on Linux or the agent version shown in the Wazuh manager.localfile entry with a snort full log path in ossec.conf).4.14.9 or later.Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.