Is CVE-2026-74045 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-74045?

CVE-2026-74045 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-74045

Description

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.