CVE-2026-62365

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.7

Description The DecodeWinevt function in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into a fixed 65,535-byte join data heap buffer. The issue occurs because the function passes the growing content length as the snprintf size instead of the OS MAXSTR buffer capacity. An enrolled agent can trigger this by submitting an EventChannel message containing four maximum-sized unnamed Data elements, which leads to a write beyond the join data buffer and corrupts adjacent heap metadata. This results in the termination of the wazuh-analysisd process when join data2 is freed, effectively stopping log ingestion for all agents managed by that instance.

Recommendations Update to version 4.14.7.