Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LSummary
CVE-2026-28221 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wazuh Wazuh. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Exhaustion Flood (T1499.001); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28221 is a stack-based buffer overflow vulnerability in the print_hex_string() function within the wazuh-remoted component of Wazuh, a free and open-source platform for threat prevention, detection, and response. The issue affects versions from 4.8.0 up to but not including 4.14.4 and arises on platforms where char is treated as signed, causing the compiled code to sign-extend bytes before a variadic sprintf call. Specifically, formatting attacker-controlled bytes such as 0xFF with sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) can emit "ffffffff" (8 characters) instead of "ff" (2 characters), leading to an out-of-bounds write beyond a fixed 2049-byte stack buffer. Additionally, the vulnerability enables remote log amplification via repeated hex dumps logged to /var/ossec/logs/ossec.log.
The vulnerability is exploitable remotely by unauthenticated attackers connecting to TCP port 1514 prior to any agent authentication or registration. An oversized length prefix in a message triggers the "unexpected message (hex)" diagnostic path, invoking the flawed print_hex_string() and causing the buffer overflow. Even without the sign-extension overflow (e.g., using bytes below 0x80), the same path logs attacker-controlled hex dumps, enabling log amplification that degrades monitoring fidelity and consumes disk and I/O resources. The CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects network accessibility with low complexity, no privileges required, and impacts to integrity and availability but not confidentiality. Associated CWEs are CWE-121 (Stack-based Buffer Overflow) and CWE-400 (Uncontrolled Resource Consumption).
Wazuh has addressed this issue in version 4.14.4, as detailed in the release notes and security advisory GHSA-q9vv-7w4c-f4cm. Security practitioners should upgrade to 4.14.4 or later to mitigate the buffer overflow and log amplification risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26270
Vulnerability Data
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using…
more
sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For input bytes such as 0xFF, the formatting can emit "ffffffff" (8 chars) instead of "ff" (2 chars), causing an out-of-bounds write past a fixed 2049-byte stack buffer. The vulnerable path is reachable remotely prior to any agent authentication/registration logic via TCP/1514 when an oversized length prefix causes the “unexpected message (hex)” diagnostic path to run. Additionally, the same unauthenticated oversized-message diagnostic path logs an attacker-controlled hex dump to /var/ossec/logs/ossec.log for each trigger, allowing remote log amplification that can degrade monitoring fidelity and consume disk/I/O. This log amplification is reachable even without triggering the sign-extension overflow (e.g., using bytes < 0x80). This issue has been patched in version 4.14.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and analysis can discover stack-buffer overflows before deployment.
SC-5 directly limits the effects of resource-exhaustion events that constitute uncontrolled consumption.
SC-6 enforces explicit allocation limits on resources, structurally preventing the weakness from occurring.
Input validation directly stops untrusted data from exceeding stack buffer bounds.
Memory-protection mechanisms limit the ability to execute injected code after a stack overflow.
Secure-engineering principles include bounds-checked coding and safe buffer handling that avoid introducing the flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicitly requires monitoring and maintaining resource capacity, directly addressing uncontrolled consumption to preserve availability.
Secure-development practices directly prevent introduction of stack buffer overflows.
Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.
Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.
Resilience mechanisms such as avoiding single points of failure indirectly reduce impact of resource exhaustion.
Hardened configuration baselines can include resource quotas and limits that constrain consumption.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Resource-utilization monitoring and alerting on bottlenecks or overloads limits the impact of denial-of-service or resource-exhaustion attacks.
Security testing (fuzzing, static analysis) detects stack overflows before release.
By continuously monitoring utilization, stress-testing peak loads, and maintaining documented plans to scale or throttle resources, the control directly limits an attacker’s ability to drive a system into uncontrolled resource exhaustion.
Pre-agreed severity-based prioritization and resource allocation during incident triage reduce the likelihood that an attacker-induced resource exhaustion will overwhelm the organization before corrective action is taken.
Business-continuity plans that include resource-management controls reduce the likelihood that an attacker can trigger uncontrolled resource consumption by forcing the system into a degraded or fallback state.
Defining RTOs and capacity requirements for ICT services during business-impact analysis forces organizations to provision sufficient resources and throttling mechanisms, reducing the likelihood that an attacker can induce denial-of-service through uncontrolled resource consumption.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248594 OL 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution. prevents CWE-121
Oracle Linux 9 (1 rule)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-121