Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-28221 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wazuh Wazuh. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28221 is a stack-based buffer overflow vulnerability in the print_hex_string() function within the wazuh-remoted component of Wazuh, a free and open-source platform for threat prevention, detection, and response. The issue affects versions from 4.8.0 up to but not including 4.14.4 and arises on platforms where char is treated as signed, causing the compiled code to sign-extend bytes before a variadic sprintf call. Specifically, formatting attacker-controlled bytes such as 0xFF with sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) can emit "ffffffff" (8 characters) instead of "ff" (2 characters), leading to an out-of-bounds write beyond a fixed 2049-byte stack buffer. Additionally, the vulnerability enables remote log amplification via repeated hex dumps logged to /var/ossec/logs/ossec.log.
The vulnerability is exploitable remotely by unauthenticated attackers connecting to TCP port 1514 prior to any agent authentication or registration. An oversized length prefix in a message triggers the "unexpected message (hex)" diagnostic path, invoking the flawed print_hex_string() and causing the buffer overflow. Even without the sign-extension overflow (e.g., using bytes below 0x80), the same path logs attacker-controlled hex dumps, enabling log amplification that degrades monitoring fidelity and consumes disk and I/O resources. The CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects network accessibility with low complexity, no privileges required, and impacts to integrity and availability but not confidentiality. Associated CWEs are CWE-121 (Stack-based Buffer Overflow) and CWE-400 (Uncontrolled Resource Consumption).
Wazuh has addressed this issue in version 4.14.4, as detailed in the release notes and security advisory GHSA-q9vv-7w4c-f4cm. Security practitioners should upgrade to 4.14.4 or later to mitigate the buffer overflow and log amplification risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26270
Vulnerability Data
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using…
more
sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For input bytes such as 0xFF, the formatting can emit "ffffffff" (8 chars) instead of "ff" (2 chars), causing an out-of-bounds write past a fixed 2049-byte stack buffer. The vulnerable path is reachable remotely prior to any agent authentication/registration logic via TCP/1514 when an oversized length prefix causes the “unexpected message (hex)” diagnostic path to run. Additionally, the same unauthenticated oversized-message diagnostic path logs an attacker-controlled hex dump to /var/ossec/logs/ossec.log for each trigger, allowing remote log amplification that can degrade monitoring fidelity and consume disk/I/O. This log amplification is reachable even without triggering the sign-extension overflow (e.g., using bytes < 0x80). This issue has been patched in version 4.14.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and analysis can discover stack-buffer overflows before deployment.
SC-5 directly limits the effects of resource-exhaustion events that constitute uncontrolled consumption.
SC-6 enforces explicit allocation limits on resources, structurally preventing the weakness from occurring.
Input validation directly stops untrusted data from exceeding stack buffer bounds.
Memory-protection mechanisms limit the ability to execute injected code after a stack overflow.
Secure-engineering principles include bounds-checked coding and safe buffer handling that avoid introducing the flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.
Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.
Resilience mechanisms such as avoiding single points of failure indirectly reduce impact of resource exhaustion.
Explicitly requires monitoring and maintaining resource capacity, directly addressing uncontrolled consumption to preserve availability.
Hardened configuration baselines can include resource quotas and limits that constrain consumption.
Patching eliminates known instances of the weakness after discovery.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Pre-agreed severity-based prioritization and resource allocation during incident triage reduce the likelihood that an attacker-induced resource exhaustion will overwhelm the organization before corrective action is taken.
Business-continuity plans that include resource-management controls reduce the likelihood that an attacker can trigger uncontrolled resource consumption by forcing the system into a degraded or fallback state.
Defining RTOs and capacity requirements for ICT services during business-impact analysis forces organizations to provision sufficient resources and throttling mechanisms, reducing the likelihood that an attacker can induce denial-of-service through uncontrolled resource consumption.
Early notification of anomalous resource consumption or system malfunctions enables throttling or isolation before availability is lost.
By duplicating processing facilities and load-balancing across instances, the control reduces the likelihood that a single resource-exhaustion attack will render the service unavailable.
Specifying log storage limits and rotation procedures reduces the risk that unbounded log growth will exhaust disk or memory resources and cause denial of service.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248594 OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. prevents CWE-121
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-121