CVE-2026-62365

Full vulnerability record from the local CVENow database.

Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.

Severity

MEDIUM

CVSS score

5.3 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 23:17:56.583000

Last modified

2026-11-04 23:17:56.583000

View original CVE JSON

{
  "id": "CVE-2026-62365",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T23:17:56.583",
  "lastModified": "2026-11-04T23:17:56.583",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wazuh",
          "product": "wazuh",
          "versions": [
            {
              "version": ">= 3.9.0, < 4.14.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/wazuh/wazuh/commit/07c5b2829f671eac0436412701a346a26555fdc7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wazuh/wazuh/pull/37198",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-whhr-gxxr-f6pm",
      "source": "[email protected]"
    }
  ]
}