CVE-2026-44251: Wazuh

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 3.0.0 and above, prior to 4.14.5, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents from the manager. A second code path reached by the same underflow may allow heap memory corruption. This issue has been fixed in version 4.14.5.

Affected products

• Wazuh Wazuh: from 3.0.0, before 4.14.5 (fixed in 4.14.5)

Published 2026-07-17. Last modified 2026-07-20.