Wazuh's _getattributes() function exhibits an unbounded recursion flaw (CWE-674) recursively processing every XML attribute without a depth limit, allocating large local buffers on each call. An attacker with the ability to send a Windows EventChannel event can craft an element containing many attributes, exhausting the analysisd worker-thread stack and causing a segmentation fault that interrupts log ingestion. The result is a denial of service to the Wazuh server, with logs stopped and the service potentially unresponsive until restarted.

The vulnerability affects Wazuh versions from 3.8.0 through 4.14.6. The issue is fixed in 4.14.7. It occurs in the analysisd component when processing agent events sent via the Windows EventChannel interface.

The CVSS score of 6.5 indicates a moderate impact, and the lack of an EPSS score means current exploitation probability is unknown but not ruled out. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that the attacker must control an agent that can send a crafted Windows EventChannel event; the likely attack vector is via a malicious agent communicating with the manager. Exploitation requires an agent capable of submitting a crafted event; once the event is processed the stack exhaustion occurs locally on the server, making this a remote denial-of-service attack if the attacker controls the agent communication channel.