CVE-2026-102413

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Elastic

Description

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102413

EUVD

EUVD-2026-93934

Affected Vendors & Products

Vendor	Product	Version / Range
Elastic	Elastic	Agent and Elastic Defend 8.19.13
Elastic	Elastic	Agent and Elastic Defend 9.2.7
Elastic	Elastic	Agent and Elastic Defend 9.3.0
Elastic	Elastic	Agent and Elastic Defend 9.4.0
Elastic	Elastic	Agent and Elastic Defend 9.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability is an Uncaught Exception (CWE-248) in Elastic Endpoint that causes a denial of service via a specially crafted file name. When the Elastic Defend component processes a file name under certain system locale configurations like Chinese, Japanese, or Korean on Windows, an unhandled exception occurs during file-path handling. This leads to repeated crashes and restarts of the Elastic Endpoint process, disrupting real-time malware prevention and behavioral detection capabilities.

Detection Guidance

Detect this vulnerability by checking for repeated crashes of the Elastic Endpoint process in Windows Event Viewer under Application or System logs. Look for errors related to file-path handling in Chinese, Japanese, or Korean locales. Monitor for degraded or disabled real-time malware prevention capabilities.

Impact Analysis

The vulnerability can degrade or disable Elastic Defend's security features on your system. This means your real-time malware detection and behavioral analysis may stop working, leaving your system more vulnerable to threats. The issue persists as long as the problematic file name condition exists.

Compliance Impact

This vulnerability can impact compliance with standards like GDPR and HIPAA by potentially disabling real-time malware prevention and behavioral detection capabilities on affected systems. This could lead to unauthorized access, data breaches, or failure to detect malicious activity, violating data protection and security requirements.

Mitigation Strategies

Update Elastic Endpoint to the latest version that addresses this issue. Temporarily switch the affected system's locale to a non-CJK language if possible. Restart the Elastic Endpoint service after applying updates. Ensure real-time malware prevention is re-enabled if disabled.

Hi! I’m here to help you understand CVE-2026-102413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70