CVE-2026-28221
Published: 29 April 2026
Summary
CVE-2026-28221 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wazuh Wazuh. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the buffer overflow flaw in wazuh-remoted, as addressed in Wazuh version 4.14.4.
Prevents the stack-based buffer overflow and log amplification by validating oversized length prefixes and attacker-controlled bytes in incoming TCP/1514 messages before processing.
Mitigates exploitation of the stack-based buffer overflow through memory protection mechanisms like stack canaries, address space randomization, and non-executable stacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of exposed Wazuh remoted service (port 1514) via crafted oversized messages directly matches T1190. Resulting stack overflow and attacker-triggered log amplification enable application-layer DoS via resource exhaustion, matching T1499.004.
NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using…
more
sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For input bytes such as 0xFF, the formatting can emit "ffffffff" (8 chars) instead of "ff" (2 chars), causing an out-of-bounds write past a fixed 2049-byte stack buffer. The vulnerable path is reachable remotely prior to any agent authentication/registration logic via TCP/1514 when an oversized length prefix causes the “unexpected message (hex)” diagnostic path to run. Additionally, the same unauthenticated oversized-message diagnostic path logs an attacker-controlled hex dump to /var/ossec/logs/ossec.log for each trigger, allowing remote log amplification that can degrade monitoring fidelity and consume disk/I/O. This log amplification is reachable even without triggering the sign-extension overflow (e.g., using bytes < 0x80). This issue has been patched in version 4.14.4.
Deeper analysisAI
CVE-2026-28221 is a stack-based buffer overflow vulnerability in the print_hex_string() function within the wazuh-remoted component of Wazuh, a free and open-source platform for threat prevention, detection, and response. The issue affects versions from 4.8.0 up to but not including 4.14.4 and arises on platforms where char is treated as signed, causing the compiled code to sign-extend bytes before a variadic sprintf call. Specifically, formatting attacker-controlled bytes such as 0xFF with sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) can emit "ffffffff" (8 characters) instead of "ff" (2 characters), leading to an out-of-bounds write beyond a fixed 2049-byte stack buffer. Additionally, the vulnerability enables remote log amplification via repeated hex dumps logged to /var/ossec/logs/ossec.log.
The vulnerability is exploitable remotely by unauthenticated attackers connecting to TCP port 1514 prior to any agent authentication or registration. An oversized length prefix in a message triggers the "unexpected message (hex)" diagnostic path, invoking the flawed print_hex_string() and causing the buffer overflow. Even without the sign-extension overflow (e.g., using bytes below 0x80), the same path logs attacker-controlled hex dumps, enabling log amplification that degrades monitoring fidelity and consumes disk and I/O resources. The CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects network accessibility with low complexity, no privileges required, and impacts to integrity and availability but not confidentiality. Associated CWEs are CWE-121 (Stack-based Buffer Overflow) and CWE-400 (Uncontrolled Resource Consumption).
Wazuh has addressed this issue in version 4.14.4, as detailed in the release notes and security advisory GHSA-q9vv-7w4c-f4cm. Security practitioners should upgrade to 4.14.4 or later to mitigate the buffer overflow and log amplification risks.
Details
- CWE(s)