CVE-2026-74045: Wazuh Wazuh-Manager

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.

Affected products

• Wazuh Wazuh-Manager: from 3.12.0, before 4.14.8 (fixed in 4.14.8)

Published 2026-10-13. Last modified 2026-10-15.