CVE-2024-32038— Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-32038
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
堆缓冲区溢出
Source: NVD (National Vulnerability Database)
Vulnerability Title
Wazuh 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wazuh是 Wazuh开源的一个应用软件。用于收集，汇总，索引和分析安全数据，帮助组织检测入侵，威胁和行为异常。 Wazuh 3.8.0 到 4.7.2版本存在安全漏洞，该漏洞源于处理来自 Windows Eventchannel 消息的 Unicode 字符时，wazuh-analysisd 中存在缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2024-32038
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-32038
请登录查看更多情报信息。
- https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2024-32038
Same Patch Batch · wazuh · 2024-04-19 · 3 CVEs total
| CVE-2023-50260 | 8.8 HIGH | Wazuh's vulnerability in host_deny AR script allows arbitrary command execution |
| CVE-2023-49275 | 6.5 MEDIUM | Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd |
IV. Related Vulnerabilities
Same product: wazuh
- CVE-2026-41499
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in p - CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enab - CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted - CVE-2026-26206
Wazuh: API brute-force protection bypass via race condition - CVE-2026-26204
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDat
Same vendor: wazuh
- CVE-2026-41499
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in p - CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enab - CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted - CVE-2026-26206
Wazuh: API brute-force protection bypass via race condition - CVE-2026-26204
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDat
Same weakness: CWE-122
- CVE-2026-8261
Squirrel sqobject.cpp Load heap-based overflow - CVE-2026-8213
OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow - CVE-2026-8212
OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow - CVE-2026-42309
Pillow: Heap buffer overflow with nested list coordinates - CVE-2026-45130
Vim: Heap Buffer Overflow in spell file loading
V. Comments for CVE-2024-32038
No comments yet