{"id":"CVE-2026-112335","title":"Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull","summary":"Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a moni…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-121"],"vendor":"wazuh","product":"wazuh","affected":["wazuh >= 1.0.0 < 4.14.9"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:00:43.252Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112335","references":[{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-3gq8-gg8f-5h8h","label":"GitHub Security Advisory (GHSA-3gq8-gg8f-5h8h)"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.9","label":"wazuh v4.14.9 Release Notes"},{"url":"https://www.vulncheck.com/advisories/wazuh-agent-1.0.0-before-4.14.9-stack-buffer-overflow-via-read-snortfull","label":"VulnCheck Advisory: Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T15:54:04.089Z","epss":0.00134,"epssPercentile":0.02898,"slug":"CVE-2026-112335","body":"## Overview\n\nWazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that miscalculates remaining buffer space in read_snortfull(). Attackers who write crafted multi-line content to a monitored snort-full log can overflow the 65,280-byte stack buffer, crashing the agent or overwriting an SEH handler on 32-bit Windows agents running as SYSTEM.\n\n## Affected\n\n- `wazuh >= 1.0.0 < 4.14.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}