CVE-2026-62365

Received Received - Intake

DecodeWinevt Heap Buffer Overflow in Wazuh

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-62365

Affected Vendors & Products

Vendor	Product	Version / Range
wazuh	wazuh	>= 3.9.0, < 4.14.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability in Wazuh involves a heap buffer overflow in the DecodeWinevt function. It occurs when processing Windows EventChannel messages with four maximum-sized unnamed Data elements. The function incorrectly uses the growing content length instead of the fixed buffer capacity when calling snprintf, leading to a write beyond the allocated heap memory. This corrupts adjacent heap metadata and causes the wazuh-analysisd process to crash, halting log ingestion for all connected agents.

Detection Guidance

This vulnerability can be detected by checking the Wazuh manager version. If it is below 4.14.7, the system is vulnerable. Run 'wazuh-control -V' to check the installed version.

Impact Analysis

If exploited, this vulnerability can cause the Wazuh manager to crash, stopping all log ingestion from enrolled agents. This disrupts security monitoring, reduces visibility into system events, and may lead to undetected security incidents. Organizations relying on Wazuh for centralized logging and threat detection could experience gaps in their security posture.

Compliance Impact

This vulnerability could impact compliance by disrupting log collection and retention required by standards like GDPR and HIPAA. Without continuous log ingestion, organizations may fail to maintain required audit trails or detect unauthorized activities, increasing non-compliance risks. The crash of the Wazuh manager could lead to gaps in evidence collection for regulatory audits.

Mitigation Strategies

Upgrade the Wazuh manager to version 4.14.7 or later immediately to patch the vulnerability. Ensure no agents are submitting EventChannel messages with large unnamed Data elements during the upgrade.

Hi! I’m here to help you understand CVE-2026-62365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...