Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-29 | 1 | Disclosure1 |
| 2026-04-30 | 1 | Active Exploitation1 |
Some increased actor activities are shown targeting Wazuh (CVE-2026-26204) https://vuldb.com/vuln/360194/cti
Post summary
The entry reports increased actor activity targeting Wazuh's CVE-2026-26204, indicating active exploitation in the wild.
CVE-2026-26204 Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds … https://www.cve.org/CVERecord?id=CVE-2026-26204
Post summary
CVE-2026-26204 identifies a heap-based out-of-bounds flaw in Wazuh versions 1.0.0 through 4.14.3; the snippet provides basic technical details but no PoC, exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wazuh | wazuh | - | - | - |