Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte join_data heap buffer but passes the growing content length, rather than the OS_MAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond join_data and corrupt adjacent heap metadata. The subsequent free of join_data2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…/wazuh/security/advisories/GHSA-whhr-gxxr-f6pm Diğer
• github.com/wazuh/wazuh/pull/37198 Diğer
• github.com/…ommit/07c5b2829f671eac0436412701a346a26555fdc7 Diğer
• github.com/wazuh/wazuh/releases/tag/v4.14.7 Diğer

Kayıt geçmişi

1. 5 Kas 2026 01:46Yayımlandı

İlgili açıklar

• 9,9 CVE-2025-24016 Aktif istismarWazuh sunucusunda güvensiz seri durumdan çıkarma ile uzaktan kod çalıştırma
• 8,2 CVE-2026-116788FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
• 9,1 CVE-2026-116785FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling
• 6,5 CVE-2026-123205accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql
• 8,3 CVE-2026-54914WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer
• 7,3 CVE-2026-112109Local privilege escalation in SafeNet Authentication Client SACSrv