CVE-2026-41499— Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()

Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string()

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

缓冲区下溢

Wazuh 安全漏洞

Wazuh是Wazuh开源的一个应用软件。用于收集，汇总，索引和分析安全数据，帮助组织检测入侵，威胁和行为异常。 Wazuh 4.0.0版本至4.14.4之前版本存在安全漏洞，该漏洞源于parse_uname_string函数中存在多个基于堆的越界写入漏洞，该函数处理来自代理的操作系统识别数据，在4个位置存在危险代码模式，当字符串为空时strlen返回0，0减1因无符号整数下溢导致SIZE_MAX，指针算术环绕使SIZE_MAX变为-1，导致在分配缓冲区前1字节处写入，破坏堆元数据，可能导致堆损坏。

N/A

N/A