Wazuh up to 4.14.6 EventChannel Decoder winevtchannel.c DecodeWinevt heap-based overflow

Summaryinfo

A vulnerability categorized as problematic has been discovered in Wazuh up to 4.14.6. This issue affects the function DecodeWinevt of the file src/analysisd/decoders/winevtchannel.c of the component EventChannel Decoder. The manipulation results in heap-based overflow. This vulnerability is reported as CVE-2026-62365. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Wazuh up to 4.14.6. Affected is the function DecodeWinevt of the file src/analysisd/decoders/winevtchannel.c of the component EventChannel Decoder. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on availability. CVE summarizes:

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-62365 since 07/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.14.7 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Wazuh

Version

• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.14.5
• 4.14.6

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion