CVE-2026-41499

The record

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4.

Affected packages

Related vulnerabilities

• CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability… CWE-124
• CVE-2026-40013 An attacker that has valid credentials can submit a Sieve script containing an extreme… CWE-124
• CVE-2026-73075 Vim is an open source, command line text editor. CWE-124
• CVE-2026-44631 Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in… CWE-124
• CVE-2024-36343 Improper input validation in the System Management Mode (SMM) communications buffer could… CWE-124
• CVE-2026-34253 A buffer underflow vulnerability has been identified in the ogg123 utility from the… CWE-124
• CVE-2026-5089 YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. CWE-124
• CVE-2026-26204 Wazuh is a free and open source platform used for threat prevention, detection, and… CWE-124