CVE-2026-102413

Executive Summary

CVE-2026-102413 is an uncaught exception vulnerability (CWE-248) in the Elastic Endpoint component of Elastic Defend on Windows. When the endpoint processes a specially crafted file name under certain system locale configurations — including Chinese, Japanese, and Korean (CJK) locales — an unhandled exception occurs during file-path handling, causing the Elastic Endpoint process to crash and restart repeatedly. The impact is a denial of service against the endpoint's own security controls (CVSS 6.2, A:H), degrading or disabling real-time malware prevention and behavioral detection for as long as the triggering condition persists.

Technical Analysis

The vulnerability is classified as CWE-248: Uncaught Exception. At its core, the flaw is a robustness failure in the file-path handling logic of the Elastic Endpoint process. The NVD description states that the exception is triggered when the component "processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows." The trigger is a "specially crafted file name," and the failure mode is "an unhandled exception can occur during file-path handling."

From a code-level perspective, this class of defect typically arises when string or path processing assumes a particular encoding, byte length, or character class that does not hold under non-Latin Windows code pages (CJK locales shift multibyte character handling, path segmentation, and normalization behavior). The description does not disclose the specific function, class, parsing routine, or API involved, so no implementation-level identifiers should be assumed. What is derivable is the mechanism: a malformed or unexpected file name input reaches a code path that does not defensively catch the resulting exception, and the exception propagates out of the process boundary, terminating it.

The attack surface is local. The CVSS vector (AV:L) and the fact that the file name is processed by an on-host endpoint agent mean the trigger reaches the vulnerability through the filesystem namespace the agent monitors — i.e., a file created, renamed, or touched on the protected host. No network vector, no privileges (PR:N), and no user interaction (UI:N) are required per the vector, meaning an attacker or any process already capable of writing to a monitored path can supply the crafted file name. The availability impact is High (A:H): the process crashes and restarts repeatedly, and each restart window plus the crash loop degrades the agent's protective functions. Confidentiality and integrity impacts are scored None (C:N/I:N) because the flaw itself does not directly expose or alter data — the security consequence is that the defensive tool is neutralized.

The persistence of the effect is a critical characteristic: "for as long as the condition persists." A single crafted file name that remains in place, or a recurring actor that repeatedly recreates it, keeps the endpoint in a crash-restart loop, sustaining the degradation rather than causing a one-time outage.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None), and the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, paths, or API parameters are invented because the description does not disclose them.

1. Reconnaissance / target identification. An adversary operating on or with access to a Windows host determines whether Elastic Defend / Elastic Endpoint is installed and whether the system locale is set to a CJK configuration (Chinese, Japanese, or Korean). Hosts in these locales are the documented preconditions. The attacker profiles monitored directories (paths the endpoint agent inspects) to understand where a crafted file name will be processed.

2. Triggering the flaw class. The attacker creates, renames, or drops a file with a specially crafted file name in a location the Elastic Endpoint component processes. When the agent's file-path handling routine encounters this input under the CJK locale, an unhandled exception is raised. Because the exception is uncaught (CWE-248), it escapes the normal control flow and terminates the Elastic Endpoint process.

3. Execution method (vulnerability-class level). This is not a code-injection or memory-corruption exploit; no payload is "executed" in the traditional sense. The "payload" is the crafted file name itself, delivered to the filesystem. Per the CVSS vector, no privileges (PR:N) and no user interaction (UI:N) are required, so a low-privileged local process or any actor able to write to a monitored path can deliver the trigger. The exception is the weaponized effect.

4. Post-exploitation impact. The Elastic Endpoint process crashes and restarts repeatedly. During each crash-and-restart cycle, and for as long as the triggering file name remains processed, the agent's real-time malware prevention and behavioral detection are degraded or disabled. An adversary can leverage this window to stage secondary malicious activity — dropping or executing malware, persisting, or exfiltrating — with reduced likelihood of detection by the impaired agent. This is a defense-evasion enabler (T1562.001) rather than a direct compromise primitive.

Impact Assessment

The CVSS 3.1 base score is 6.2 (Medium), with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The subscores indicate:

• Attack Vector: Local — the trigger must be delivered on the host; this is not remotely exploitable over the network.
• Attack Complexity: Low — no special conditions beyond the CJK locale requirement are described; the trigger is deterministic given the precondition.
• Privileges Required: None — a low- or unprivileged actor can deliver the crafted file name.
• User Interaction: None — no victim action is needed beyond the agent processing the file.
• Scope: Unchanged — impact is confined to the vulnerable component.
• Confidentiality / Integrity: None — the flaw does not directly affect data.
• Availability: High — the endpoint security agent is crashed and disabled.

Business impact centers on the loss of endpoint detection and response (EDR) coverage. Affected systems are Windows hosts running Elastic Defend's Elastic Endpoint component, particularly those configured with Chinese, Japanese, or Korean system locales. The blast radius is per-host: each affected machine in such an environment can be individually knocked out of protection by a local actor. In environments where CJK locales are common, this represents a systemic weakening of endpoint security posture, enabling follow-on attacks to proceed with materially reduced detection. The repeated crash-restart loop also generates operational noise (agent telemetry gaps, restart events) that may mask adversary activity. No EPSS score has been assigned as of this writing; CISA KEV status is NO; no public exploit or Nuclei template exists.

Detection Guidance

Sigma Rule

title: Elastic Endpoint Crash/Restart Loop Indicating CWE-248 DoS (CVE-2026-102413)
id: 8f3a1c2e-6b47-4d9a-9e21-0a7c5d3b1f88
status: experimental
description: Detects repeated crash and restart of the Elastic Endpoint process on Windows hosts, potentially caused by a crafted file name triggering an uncaught exception under CJK locales.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102413
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.defense-evasion
  - attack.t1562.001
logsource:
  product: windows
  service: application
detection:
  selection_provider:
    Provider_Name: 'Elastic'
  selection_crash:
    EventID:
      - 1000
      - 1001
    Message|contains:
      - 'Elastic Endpoint'
      - 'elastic-endpoint.exe'
  selection_restart:
    EventID: 7031
    Message|contains: 'Elastic'
  condition: selection_provider and (selection_crash or selection_restart)
falsepositives:
  - Legitimate product updates or planned service restarts
level: medium

YARA Rule

rule CVE_2026_102413_Elastic_Endpoint_DOS_Filename
{
    meta:
        description = "Detects crafted file names targeting Elastic Endpoint file-path handling under CJK locales (CVE-2026-102413). Heuristic placeholder."
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102413"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cjk1 = { E4 B8 } // UTF-8 CJK lead byte range (Chinese)
        $cjk2 = { E3 81 } // UTF-8 Hiragana/CJK (Japanese)
        $cjk3 = { EA B0 } // UTF-8 Hangul lead bytes (Korean)
        $mz = { 4D 5A }

    condition:
        filesize < 512 and
        ($cjk1 or $cjk2 or $cjk3) and
        not $mz
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-102413 Elastic Endpoint Defense Evasion - Crash Loop Indicator"; flow:to_server; content:"elastic-endpoint"; nocase; threshold:type threshold, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:2026102413; rev:1;)

Elastic Detection

process where event.type in ("stop", "end") and
  process.name == "elastic-endpoint.exe" and
  process.exit_code != 0
sequence by host.id with maxspan=10m
  [ process where event.type == "end" and process.name == "elastic-endpoint.exe" ] with runs=3

Splunk SPL Query

index=wineventlog (source="WinEventLog:Application" OR source="WinEventLog:System")
(EventCode=1000 OR EventCode=1001 OR EventCode=7031 OR EventCode=7034)
("elastic-endpoint.exe" OR "Elastic Endpoint" OR "Elastic Defend")
| stats count min(_time) as firstTime max(_time) as lastTime by host, EventCode, Message
| where count >= 3
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="windows,elastic,defense_evasion,">
  <rule id="202610" level="10">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Elastic</field>
    <field name="win.system.eventID">1000|1001|7031|7034</field>
    <description>CVE-2026-102413: Elastic Endpoint crash/restart loop detected - possible defense evasion DoS</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
    <group>defense_evasion,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range was available in the provided intelligence data.

1. Immediate mitigations.

   • Identify Windows hosts running Elastic Defend with Chinese, Japanese, or Korean system locales, as these match the documented precondition.
   • Monitor for Elastic Endpoint crash/restart loops (see detection rules above); investigate any host exhibiting repeated agent restarts and audit recently created or renamed files for anomalous file names.
   • Restrict filesystem write access to monitored paths where feasible, reducing the number of actors that can place a crafted file name.
   • Where a specific triggering file name is identified operationally, quarantine or remove that file to break the crash loop (the description ties sustained impact to the persistence of the condition).
   • Maintain a compensating detective control (network monitoring, alternate log sources) for hosts whose endpoint agent is degraded.

2. Patch/upgrade steps.

   • No patch is available per current tracking. Monitor Elastic's official security advisories and release notes for Elastic Defend / Elastic Endpoint updates addressing CWE-248, and apply vendor-released fixes as soon as they are published and validated.
   • Verify signatures and versions of Elastic Endpoint after any update, and confirm the crash condition no longer reproduces in a test CJK-locale environment before broad rollout.

3. Long-term hardening.

   • Enforce defensive input handling expectations with the vendor (robust path parsing across all locale/encoding configurations); track the CWE-248 class issue through vendor disclosures.
   • Reduce reliance on a single endpoint agent by deploying layered detection (host + network) so that impairment of one agent does not create a detection blind spot.
   • Establish alerting on endpoint agent health, restart frequency, and telemetry gaps as a standard SOC monitoring use case, since defense-evasion-by-availability attacks target exactly that blind spot.
   • Apply least privilege and application control to limit low-privileged actors' ability to create arbitrary file names in monitored directories.

References

• NVD — CVE-2026-102413: https://nvd.nist.gov/vuln/detail/CVE-2026-102413
• CWE-248: Uncaught Exception: https://cwe.mitre.org/data/definitions/248.html
• MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools: https://attack.mitre.org/techniques/T1562/001/
• Elastic Security Advisories (monitor for the corresponding vendor advisory): https://www.elastic.co/community/security
• CISA Known Exploited Vulnerabilities Catalog (status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. No evidence of exploit-in-the-wild activity or associated threat actor campaigns was identified in the provided intelligence data. CISA KEV status: NO.