CVE-2026-62365Medium· 5.3▾ SunlitWazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.
wazuh >= 3.9.0, < 4.14.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71540High· 7.5Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
CVE-2026-61811Medium· 6.5Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads
CVE-2026-44251Medium· 6.5Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-40106Medium· 4.7Wazuh is a free and open source platform used for threat prevention, detection, and response
CVE-2026-112334Medium· 4.9Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.conf
CVE-2026-112335Medium· 5.5Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfull