---
id: "CVE-2026-62365"
kind: "vulnerability"
aliases: ["CVE-2026-62365"]
title: "Wazuh: enrolled agent can crash the manager's log analysis daemon"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "siem", "wazuh", "windows", "xdr"]
not_affected_if: ["managed-hosting", "no-windows-eventchannel"]
published_at: "2026-11-04T23:17:56+00:00"
first_seen_at: "2026-11-05T00:31:00+00:00"
updated_at: "2026-11-05T00:31:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62365", "first_seen_at": "2026-11-05T00:31:00+00:00"}]
exploit_sources: []
---

# Wazuh: enrolled agent can crash the manager's log analysis daemon

A bug in Wazuh's Windows EventChannel decoder lets an enrolled agent send a crafted message that overflows a heap buffer in wazuh-analysisd. The crash stops log ingestion for every agent that the manager handles.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wazuh manager version with `/var/ossec/bin/wazuh-control info` and compare it with the fixed version.
- Confirm whether the manager accepts EventChannel data from agents, which is the path that reaches the decoder.

## Fix

- Wazuh: upgrade to `4.14.7` or later.

## Timeline

- 2026-11-05T00:31:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62365

## Documents

- [advisory] Vendor advisory: github.com https://github.com/wazuh/wazuh/security/advisories/GHSA-whhr-gxxr-f6pm
- [fix] Patch: github.com https://github.com/wazuh/wazuh/commit/07c5b2829f671eac0436412701a346a26555fdc7
- [fix] Release notes: github.com https://github.com/wazuh/wazuh/releases/tag/v4.14.7

## From the sources

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_