{"apiVersion":"1.0","identifier":"CVE-2026-45798","description":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TCP port 1515 when anonymous TLS enrollment is enabled. A version string of at least nine non-null bytes can cause strchr() and strtok() to read beyond ver2 and can make strtok() write a null byte into adjacent stack memory, allowing a remote denial of service. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.","publishedAt":"2026-08-19T17:18:49","lastModifiedAt":"2026-08-19T18:16:39","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45798","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.00496,"riskScore":0.78,"affectedProduct":"Wazuh","affectedVersions":">=4.5.0,<4.14.6,==5.0.0-beta2","vulnerabilityType":"Critical software","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-45798","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-45798","en":"https://www.redsauce.net/en/cves/CVE-2026-45798","fr":"https://www.redsauce.net/fr/cves/CVE-2026-45798","pt":"https://www.redsauce.net/pt/cves/CVE-2026-45798","de":"https://www.redsauce.net/de/cves/CVE-2026-45798","sk":"https://www.redsauce.net/sk/cves/CVE-2026-45798","el":"https://www.redsauce.net/el/cves/CVE-2026-45798"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-45798"}}