---
id: CVE-2026-61811
title: >-
  Wazuh is an open-source security platform providing unified XDR and SIEM
  protection for endpoints and cloud workloads
summary: >-
  Wazuh is an open-source security platform providing unified XDR and SIEM
  protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the
  _getattributes() function in src/os_xml/os_xml.c recursively processes every
  XML attribut…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: wazuh
product: wazuh
affected:
  - 'wazuh >= 3.8.0, < 4.14.7'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T19:17:15.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61811'
references:
  - url: >-
      https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/pull/37147'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/releases/tag/v4.14.7'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5'
    label: security-advisories@github.com
  - url: 'https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T18:02:16.205270Z'
ingestedAt: '2026-09-24T18:49:36.709Z'
---

## Overview

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.