CVE-2026-61811

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.8.0 through 4.14.6

Description The getattributes() function in src/os xml/os xml.c recursively processes XML attributes without a depth limit and allocates two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with a high number of attributes to exhaust the analysisd worker-thread stack. This leads to a segmentation fault—a memory access violation that causes a program to crash—and interrupts log ingestion. The depth limit in the ReadElem() function does not restrict the number of attributes on a single element, failing to prevent this condition.

Recommendations Update to version 4.14.7.