{"id":"CVE-2026-62365","kind":"vulnerability","aliases":["CVE-2026-62365"],"related":[],"title":"Wazuh: enrolled agent can crash the manager's log analysis daemon","description":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.","summary":"A bug in Wazuh's Windows EventChannel decoder lets an enrolled agent send a crafted message that overflows a heap buffer in wazuh-analysisd. The crash stops log ingestion for every agent that the manager handles.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","siem","wazuh","windows","xdr"],"not_affected_if":["managed-hosting","no-windows-eventchannel"],"how_to_check":"- Check the Wazuh manager version with `/var/ossec/bin/wazuh-control info` and compare it with the fixed version.\n- Confirm whether the manager accepts EventChannel data from agents, which is the path that reaches the decoder.","fix":"- Wazuh: upgrade to `4.14.7` or later.","status":"open","published_at":"2026-11-04T23:17:56+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:59+00:00","updated_at":"2026-11-05T00:31:59+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-05T00:31:59Z","model":"claude-haiku-5-5","output":{"fix":"- Wazuh: upgrade to `4.14.7` or later.","reach":"network","title":"Wazuh: enrolled agent can crash the manager's log analysis daemon","impact":"low","summary":"A bug in Wazuh's Windows EventChannel decoder lets an enrolled agent send a crafted message that overflows a heap buffer in wazuh-analysisd. The crash stops log ingestion for every agent that the manager handles.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wazuh","siem","xdr","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Log ingestion stops for all agents when the analysis daemon crashes","analyst_note":"","how_to_check":"- Check the Wazuh manager version with `/var/ossec/bin/wazuh-control info` and compare it with the fixed version.\n- Confirm whether the manager accepts EventChannel data from agents, which is the path that reaches the decoder.","plain_action":"","needs_analyst":false,"not_affected_if":["no-windows-eventchannel","managed-hosting"],"who_is_affected":"Teams that run a Wazuh manager with enrolled Windows agents sending EventChannel logs are exposed. The flaw needs an agent that is already enrolled, so anyone who can enroll an agent or compromise one can reach it. Installations that do not run the analysis daemon on Windows event data are less likely to be exposed, but the sources do not say which configurations are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4450,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62365':14A,17A '4.14.7':175C '535':93C '65':92C 'accumul':82C,135C 'adjac':143C 'agent':3A,34B,55B,118C,165C 'analysi':10A 'analysisd':47B,156C 'beyond':138C 'buffer':43B,98C,110C 'bug':24B 'byte':94C 'capac':111C 'caus':132C,152C 'cloud':77C 'contain':124C 'content':88C,103C 'corrupt':142C 'craft':37B 'crash':5A,49B 'cve':12A,15A 'daemon':11A 'data':86C,96C,130C,140C 'data2':151C 'decod':30B 'decodewinevt':79C 'element':87C,131C 'endpoint':75C 'enrol':2A,33B,117C 'eventchannel':29B,85C,122C 'everi':54B 'fix':91C,173C 'four':125C 'fourth':134C 'free':148C 'grow':102C 'handl':59B,166C 'heap':42B,97C,144C 'ingest':52B,162C 'join':95C,139C,150C 'length':104C 'let':31B 'log':9A,51B,161C 'manag':7A,58B,169C 'maximum':127C 'maximum-s':126C 'maxstr':109C 'messag':38B,123C 'metadata':145C 'open':64C 'open-sourc':63C 'os':108C 'overflow':40B 'pass':100C 'platform':67C 'process':157C 'protect':73C 'provid':68C 'rather':105C 'secur':66C 'send':35B 'siem':19B,72C 'size':115C,128C 'snprintf':114C 'sourc':65C 'src/analysisd/decoders/winevtchannel.c':81C 'stop':50B,160C 'submit':120C 'subsequ':147C 'termin':159C 'unifi':69C 'unnam':83C,129C 'vulner':171C 'wazuh':1A,20B,26B,46B,60C,155C 'wazuh-analysisd':45B,154C 'window':21B,28B,84C 'workload':78C 'write':137C 'xdr':22B,70C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a Wazuh manager with enrolled Windows agents sending EventChannel logs are exposed. The flaw needs an agent that is already enrolled, so anyone who can enroll an agent or compromise one can reach it. Installations that do not run the analysis daemon on Windows event data are less likely to be exposed, but the sources do not say which configurations are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","siem","wazuh","windows","xdr"],"campaign_type":null,"first_public_at":"2026-08-18T07:29:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62365","severity":null,"published_at":"2026-11-04T23:17:56+00:00","modified_at":"2026-11-04T23:17:56+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null}],"documents":[{"id":71488,"url":"https://github.com/wazuh/wazuh/commit/07c5b2829f671eac0436412701a346a26555fdc7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71489,"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71490,"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-whhr-gxxr-f6pm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-18T07:29:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}