{"id":"CVE-2026-112335","kind":"vulnerability","aliases":["CVE-2026-112335"],"related":[],"title":"Wazuh agent: stack overflow in snort-full log reader crashes or hijacks agent","description":"Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.","summary":"The Wazuh agent's logcollector miscalculates buffer space when reading multi-line snort-full logs, causing a stack buffer overflow. An attacker who can write crafted content into a monitored snort-full log can crash the agent or, on 32-bit Windows agents running as SYSTEM, overwrite an SEH handler to potentially run code.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","snort","wazuh","wazuh-agent","windows"],"not_affected_if":["agent-at-or-above-4.14.9","no-snort-full-logs"],"how_to_check":"- Check the installed agent version on each monitored host, for example `/var/ossec/bin/wazuh-control info` on Linux or the agent version shown in the Wazuh manager.\n- Confirm whether the logcollector is configured to monitor snort-full logs (a `localfile` entry with a snort full log path in `ossec.conf`).\n- Check whether any 32-bit Windows agents run the service as SYSTEM.","fix":"- Wazuh agent: move to `4.14.9` or later.","status":"open","published_at":"2026-11-06T15:17:07+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:28+00:00","updated_at":"2026-11-06T15:44:28+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-06T15:44:28Z","model":"claude-haiku-5-5","output":{"fix":"- Wazuh agent: move to `4.14.9` or later.","reach":"local","title":"Wazuh agent: stack overflow in snort-full log reader crashes or hijacks agent","impact":"high","summary":"The Wazuh agent's logcollector miscalculates buffer space when reading multi-line snort-full logs, causing a stack buffer overflow. An attacker who can write crafted content into a monitored snort-full log can crash the agent or, on 32-bit Windows agents running as SYSTEM, overwrite an SEH handler to potentially run code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wazuh","wazuh-agent","snort","windows","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"agent crashes, or on 32-bit Windows SYSTEM code may run","analyst_note":"","how_to_check":"- Check the installed agent version on each monitored host, for example `/var/ossec/bin/wazuh-control info` on Linux or the agent version shown in the Wazuh manager.\n- Confirm whether the logcollector is configured to monitor snort-full logs (a `localfile` entry with a snort full log path in `ossec.conf`).\n- Check whether any 32-bit Windows agents run the service as SYSTEM.","plain_action":"","needs_analyst":false,"not_affected_if":["no-snort-full-logs","agent-at-or-above-4.14.9"],"who_is_affected":"Only Wazuh agents from 1.0.0 before 4.14.9 that monitor snort-full log files are exposed. The risk is highest for 32-bit Windows agents running as SYSTEM, where an overwrite could lead to code execution; other agents mainly risk a crash. Hosts that do not run the agent or do not read snort-full logs can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000774,"input_tokens":4339,"output_tokens":680,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112335':17A,20A '-2026':16A,19A '1.0.0':89C '280':134C '32':71B,147C '4.14.9':91C '65':133C 'agent':2A,14A,27B,31B,68B,74B,87C,140C,150C 'attack':52B,115C 'base':96C 'bit':72B,148C 'buffer':35B,49B,97C,110C,137C 'byte':135C 'caus':46B 'code':85B 'contain':92C 'content':57B,122C 'craft':56B,118C 'crash':11A,66B,138C 'cve':15A,18A 'full':8A,44B,63B,104C,128C 'handler':81B,145C 'hijack':13A 'infrastructur':21B 'line':41B,121C 'linux':22B 'log':9A,45B,64B,105C,129C 'logcollector':33B,101C 'miscalcul':34B,108C 'monitor':60B,125C 'multi':40B,120C 'multi-lin':39B,119C 'overflow':4A,50B,98C,131C 'overwrit':78B,142C 'potenti':83B 'read':38B,113C 'reader':10A,106C 'remain':109C 'run':75B,84B,151C 'seh':80B,144C 'snort':7A,23B,43B,62B,103C,127C 'snort-ful':6A,42B,61B,102C,126C 'snortful':114C 'space':36B,111C 'stack':3A,48B,95C,136C 'stack-bas':94C 'system':77B,153C 'wazuh':1A,24B,26B,30B,86C 'wazuh-ag':25B 'window':28B,73B,149C 'write':55B,117C","nicknames":[],"mitigations":[],"who_affected":"Only Wazuh agents from 1.0.0 before 4.14.9 that monitor snort-full log files are exposed. The risk is highest for 32-bit Windows agents running as SYSTEM, where an overwrite could lead to code execution; other agents mainly risk a crash. Hosts that do not run the agent or do not read snort-full logs can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linux","medium","snort","wazuh","wazuhagent","windows"],"campaign_type":null,"search_a":"'-112335':17A,20A '-2026':16A,19A 'agent':2A,14A 'crash':11A 'cve':15A,18A 'full':8A 'hijack':13A 'log':9A 'overflow':4A 'reader':10A 'snort':7A 'snort-ful':6A 'stack':3A 'wazuh':1A","search_b":"'32':71B 'agent':27B,31B,68B,74B 'attack':52B 'bit':72B 'buffer':35B,49B 'caus':46B 'code':85B 'content':57B 'craft':56B 'crash':66B 'full':44B,63B 'handler':81B 'infrastructur':21B 'line':41B 'linux':22B 'log':45B,64B 'logcollector':33B 'miscalcul':34B 'monitor':60B 'multi':40B 'multi-lin':39B 'overflow':50B 'overwrit':78B 'potenti':83B 'read':38B 'run':75B,84B 'seh':80B 'snort':23B,43B,62B 'snort-ful':42B,61B 'space':36B 'stack':48B 'system':77B 'wazuh':24B,26B,30B 'wazuh-ag':25B 'window':28B,73B 'write':55B","search_c":"'1.0.0':89C '280':134C '32':147C '4.14.9':91C '65':133C 'agent':87C,140C,150C 'attack':115C 'base':96C 'bit':148C 'buffer':97C,110C,137C 'byte':135C 'contain':92C 'content':122C 'craft':118C 'crash':138C 'full':104C,128C 'handler':145C 'line':121C 'log':105C,129C 'logcollector':101C 'miscalcul':108C 'monitor':125C 'multi':120C 'multi-lin':119C 'overflow':98C,131C 'overwrit':142C 'read':113C 'reader':106C 'remain':109C 'run':151C 'seh':144C 'snort':103C,127C 'snort-ful':102C,126C 'snortful':114C 'space':111C 'stack':95C,136C 'stack-bas':94C 'system':153C 'wazuh':86C 'window':149C 'write':117C","first_public_at":"2026-11-06T10:27:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112335","severity":null,"published_at":"2026-11-06T15:17:07+00:00","modified_at":"2026-11-06T15:17:07+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87519,"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87523,"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-3gq8-gg8f-5h8h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T10:27:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87524,"url":"https://www.vulncheck.com/advisories/wazuh-agent-1.0.0-before-4.14.9-stack-buffer-overflow-via-read-snortfull","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}