Improper Encoding Handling in Elastic Defend for Windows Systems
CVE-2024-37284

5.5MEDIUM

Key Information:

Vendor
Elastic
Status
Elastic Defend
Vendor
CVE Published:
21 January 2025

Summary

An improper handling of alternate encoding vulnerability exists in Elastic Defend on Windows systems when processing files or processes encoded as multibyte characters. This flaw can trigger an uncaught exception, causing Elastic Defend to crash. As a result, the system may fail to quarantine malicious files or terminate harmful processes, potentially compromising system security.

Affected Version(s)

Elastic Defend Windows 8.0.0 < 8.13.3

References

https://discuss.elastic.co/t/elastic-defend-8-13-3-securi...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.