CVE-2026-62365 · Other
NO FIX YET · SEE WHAT TO DO
A bug in Wazuh's Windows EventChannel decoder lets an enrolled agent send a crafted message that overflows a heap buffer in wazuh-analysisd. The crash stops log ingestion for every agent that the manager handles.
first public Aug 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a Wazuh manager with enrolled Windows agents sending EventChannel logs are exposed. The flaw needs an agent that is already enrolled, so anyone who can enroll an agent or compromise one can reach it. Installations that do not run the analysis daemon on Windows event data are less likely to be exposed, but the sources do not say which configurations are safe.
Not affected if managed-hosting, no-windows-eventchannel
Who cares siem, wazuh, windows, xdr
/var/ossec/bin/wazuh-control info and compare it with the fixed version.4.14.7 or later.Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.