Homepage

CVE-2026-102413 Affecting elastic-agent-9.4-oci-entrypoint package, versions <9.4.8-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.13% (3rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-ELASTICAGENT94OCIENTRYPOINT-20942343
  • published15 Oct 2026
  • disclosed6 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2026

NewCVE-2026-102413  (opens in a new tab)

How to fix?

Upgrade Minimos:latest elastic-agent-9.4-oci-entrypoint to version 9.4.8-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream elastic-agent-9.4-oci-entrypoint package and not the elastic-agent-9.4-oci-entrypoint package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.