7.1
HIGH
CVSS 4.0
CVE-2026-56401
Wazuh - NULL Pointer Dereference in inventory_sync DataValue FlatBuffer Handling
Overview
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Details
INFO
Published Date :
July 8, 2026, 2:17 p.m.
Last Modified :
July 15, 2026, 12:18 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
Update wazuh-modulesd to version 5.0.0-beta3 or later to fix the null pointer dereference.
- Update wazuh-modulesd to version 5.0.0-beta3 or later.
- Apply vendor patches when available.
- Validate input data for missing fields.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-56401 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-56401 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Jul. 15, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Jul. 15, 2026
Action Type Old Value New Value Changed Description Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventory_sync FlatBuffer DataValue handling. An enrolled agent can send a verifier-valid DataValue message omitting the optional id field, causing wazuh-modulesd to crash when dereferencing data->id()->string_view() without null validation, resulting in denial of service. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V4.0 VulnCheck: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V3.1 VulnCheck: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Removed CWE VulnCheck: CWE-476 Removed CPE Configuration OR *cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* versions up to (excluding) 5.0.0 *cpe:2.3:a:wazuh:wazuh:5.0.0:alpha0:*:*:*:*:*:* *cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:* *cpe:2.3:a:wazuh:wazuh:5.0.0:beta2:*:*:*:*:*:* Removed Reference VulnCheck: https://github.com/wazuh/wazuh/commit/3adf4f87942705aa0ceeba1e145c259cc9dcd242 Removed Reference VulnCheck: https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Removed Reference VulnCheck: https://www.vulncheck.com/advisories/wazuh-null-pointer-dereference-in-inventory-sync-datavalue-flatbuffer-handling Removed Reference CISA-ADP: https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Removed Reference Type VulnCheck: https://github.com/wazuh/wazuh/commit/3adf4f87942705aa0ceeba1e145c259cc9dcd242 Types: Patch Removed Reference Type VulnCheck: https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Types: Exploit, Mitigation, Vendor Advisory Removed Reference Type VulnCheck: https://www.vulncheck.com/advisories/wazuh-null-pointer-dereference-in-inventory-sync-datavalue-flatbuffer-handling Types: Patch, Third Party Advisory Removed Reference Type CISA-ADP: https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Types: Exploit, Mitigation, Vendor Advisory Removed Affected [{'vendor': 'Wazuh', 'product': 'Wazuh', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '5.0.0-beta3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.0.0-beta3', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] Removed SSVC {'id': 'CVE-2026-56401', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-08T14:22:11.268856Z'} -
Initial Analysis by [email protected]
Jul. 09, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* versions up to (excluding) 5.0.0 *cpe:2.3:a:wazuh:wazuh:5.0.0:alpha0:*:*:*:*:*:* *cpe:2.3:a:wazuh:wazuh:5.0.0:beta1:*:*:*:*:*:* *cpe:2.3:a:wazuh:wazuh:5.0.0:beta2:*:*:*:*:*:* Added Reference Type VulnCheck: https://github.com/wazuh/wazuh/commit/3adf4f87942705aa0ceeba1e145c259cc9dcd242 Types: Patch Added Reference Type VulnCheck: https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Types: Exploit, Mitigation, Vendor Advisory Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/wazuh-null-pointer-dereference-in-inventory-sync-datavalue-flatbuffer-handling Types: Patch, Third Party Advisory Added Reference Type CISA-ADP: https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Types: Exploit, Mitigation, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 08, 2026
Action Type Old Value New Value Added Reference https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Added SSVC {'id': 'CVE-2026-56401', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-08T14:22:11.268856Z'} -
New CVE Received by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Wazuh', 'product': 'Wazuh', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '5.0.0-beta3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.0.0-beta3', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] Added Description Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventory_sync FlatBuffer DataValue handling. An enrolled agent can send a verifier-valid DataValue message omitting the optional id field, causing wazuh-modulesd to crash when dereferencing data->id()->string_view() without null validation, resulting in denial of service. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added Reference https://github.com/wazuh/wazuh/commit/3adf4f87942705aa0ceeba1e145c259cc9dcd242 Added Reference https://github.com/wazuh/wazuh/security/advisories/GHSA-6hxp-c9x3-qc7p Added Reference https://www.vulncheck.com/advisories/wazuh-null-pointer-dereference-in-inventory-sync-datavalue-flatbuffer-handling
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.