GHSA-whhr-gxxr-f6pm: Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte joindata heap buffer but passes the growing content length, rather than the OSMAXSTR buffer capacity, as the snprintf size. An enrolled agent can submit an EventChannel message containing four maximum-sized unnamed Data elements, causing the fourth accumulation to write beyond joindata and corrupt adjacent heap metadata. The subsequent free of joindata2 causes the wazuh-analysisd process to terminate, stopping log ingestion for all agents handled by that manager. This vulnerability is fixed in 4.14.7.