CVE-2023-7340

MediumCVSS 4.3/10Last modified Oct 28, 2026

Description

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. Attackers can exploit this vulnerability to trigger a denial of service condition, resulting in low availability impact to the authentication daemon.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Wazuh	Wazuh	>= 3.5.0, <= 4.3.10

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-grjq-p5fg-m24rExploit, Vendor Advisory
https://www.vulncheck.com/advisories/heap-buffer-overflow-in-wazuh-authdThird Party Advisory

Timeline

Published: Mar 27, 2026
Last modified: Oct 28, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-73428.8HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with oper CVE-2023-73437.8Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02 contain an arbitrary code execution vulnerability triggered CVE-2023-73456.5Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers CVE-2023-73464.0Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin add CVE-2023-73568.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID CVE-2023-73578.6A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addres