Buffer Overflow in Wazuh Security Platform Affects EventChannel Data Processing

CVE-2026-62365

What is CVE-2026-62365?

The vulnerability within the Wazuh Security Platform stems from a buffer overflow issue in the handling of unnamed Windows EventChannel Data within its processing module. Specifically, the DecodeWinevt function in src/analysisd/decoders/winevtchannel.c is susceptible to improper management of content length, which leads to overflow of the join_data heap buffer. When an enrolled agent submits a maximum-sized EventChannel message containing four unwieldy Data elements, this triggers an overflow that corrupts adjacent heap metadata. The failure to appropriately manage buffer size not only compromises the integrity of the data but also causes the wazuh-analysisd process to crash, halting log ingestion for all managed agents. The issue has been rectified in version 4.14.7.

References