CVE-2026-56401— Wazuh - NULL Pointer Dereference in inventory_sync DataValue FlatBuffer Handling
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wazuh - NULL Pointer Dereference in inventory_sync DataValue FlatBuffer Handling
Source: NVD (National Vulnerability Database)
Vulnerability Description
Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventory_sync FlatBuffer DataValue handling. An enrolled agent can send a verifier-valid DataValue message omitting the optional id field, causing wazuh-modulesd to crash when dereferencing data->id()->string_view() without null validation, resulting in denial of service.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
空指针解引用
Source: NVD (National Vulnerability Database)
Vulnerability Title
Wazuh 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wazuh是美国Wazuh公司开源的一个应用软件。用于收集,汇总,索引和分析安全数据,帮助组织检测入侵,威胁和行为异常。 Wazuh 5.0.0-beta3之前版本存在异常处理不当漏洞，该漏洞源于在inventory_sync FlatBuffer DataValue处理中存在空指针取消引用，已注册的代理可以发送省略可选id字段的经过验证的DataValue消息，在未进行空值验证的情况下取消引用data->id()->string_view()，导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56401
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56401 (2)
IV. Related Vulnerabilities
Same product: Wazuh
- CVE-2026-41499
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in p - CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enab - CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted - CVE-2026-26206
Wazuh: API brute-force protection bypass via race condition - CVE-2026-26204
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDat
Same vendor: Wazuh
- CVE-2026-41499
Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in p - CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enab - CVE-2026-28221
Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted - CVE-2026-26206
Wazuh: API brute-force protection bypass via race condition - CVE-2026-26204
Wazuh: Heap-based NULL WRITE Buffer Underflow in GetAlertDat
Same weakness: CWE-476
- CVE-2026-58101
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow de - CVE-2026-55783
NanaZip: NULL pointer dereference in Extract() of all seven - CVE-2026-21901
Junos OS and Junos OS Evolved: Configuration of a specific S - CVE-2026-60109
Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_E - CVE-2026-15184
GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer der
V. Comments for CVE-2026-56401
No comments yet