AI analysis
CVE-2026-102413 is an uncaught exception (CWE-248) in Elastic Defend's Elastic Endpoint component that can crash the agent when it processes a specially crafted file name. The fault occurs during file-path handling on Windows when the system locale is one of certain configurations, including Chinese, Japanese, and Korean. A local attacker needs no privileges and no user interaction; the endpoint process crashes and restarts repeatedly, which can degrade or disable real-time malware prevention and behavioral detection on that host for as long as the condition persists. There is no confidentiality or integrity impact. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Update Elastic Defend's Elastic Endpoint agent to the fixed release in Elastic's advisory for this CVE as soon as it is available, and confirm the agent stays running after the update. Until then, watch Windows hosts configured with Chinese, Japanese, or Korean locales for Elastic Endpoint crash-and-restart loops, and treat a looping agent as a loss of real-time malware prevention and behavioral detection on that host.
Affected
| Elastic Endpoint (Elastic Defend) | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.