This Trellix Endpoint Detection and Response (On-premises) release includes new features, enhancements, and resolved issues for Windows version 4.2.3 and Linux version 4.2.2 endpoints.
Release details
Component | Version |
|---|---|
Trellix EDR Client for Windows | 4.2.3.6356 |
Trellix EDR Client for Linux | 4.2.2.5367 |
Trellix EDR Client Extension | 4.2.2.3 |
Trellix EDR Windows Rules | 4.2.3.6356 |
Trellix EDR Linux Rules | 4.2.2.5367 |
Note
EDR Linux client 4.2.2 is the minimum supported version required by Trellix Agent 5.8.7 or later.
New or changed
Windows
Installation checks for the EDR with Forensics Client
The installer for the Trellix EDR Client for Windows checks whether the Trellix EDR with Forensics (EDRF) Client is installed on the endpoint. If the Trellix EDRF Client is detected, the installation stops automatically.
Use FIPS 140-3 compliant OpenSSL libraries on Windows
Trellix EDR Client for Windows now supports FIPS 140-3 standards. The Trellix EDR Client for Windows upgrades its OpenSSL libraries to version 3.1.2 when operating in FIPS mode and to version 3.5.6 in non-FIPS mode.
Linux
Installation checks for the EDR with Forensics Client
The installer for the Trellix EDR Client for Linux checks whether the Trellix EDRF Client is installed on the endpoint. If the Trellix EDRF Client is detected, the installation stops automatically.
Use FIPS 140-3 compliant OpenSSL libraries on Linux
Trellix EDR Client for Linux now supports FIPS 140-3 standards. The Trellix EDR Client and Trace plugin for Linux upgrades OpenSSL libraries to comply with FIPS 140-3 standards.
Resolved issues
Windows
Reference | Resolution |
|---|---|
SEC-212605 | Resolves an issue that caused a system crash due to an invalid memory access |
SEC-213041 | Resolves an issue that caused a system crash due to |
SEC-214689 | Resolves an issue that caused a system crash due to |
SEC-217415 | Resolves an issue where the Trellix EDR Client used an outdated OpenSSL library version affected by CVE-2025-15467. |
SEC-202833 | Resolves an issue where deep API inspection caused the Windows DHCP service ( |
SEC-213041 | Resolves an issue where Trellix EDR Client caused system crashes on multi-node NUMA servers due to legacy CPU affinity API restrictions. |
SEC-215713 | Resolves an issue where software installations failed when Trellix EDR Trace prevented file deletion for active applications. |
SEC-215098 | Resolves an issue where Trellix EDR Client failed to send trace events due to JSON parsing errors from malformed DNS telemetry payloads. |
SEC-200077 | Resolves an issue where Google Chrome failed to update on Windows servers when Trellix EDR Trace held temporary file locks during scanning. |
SEC-202653 | Resolves an issue where the Trellix EDR Trace plugin caused third-party applications to freeze during execution. |
SEC-191721 | Resolves an issue where process exclusions using environment variables failed due to system-level path expansion. |
SEC-210511 | Resolves an issue where running the repair command option caused inconsistent installation behavior. |
SEC-210613 | Resolves an issue where network quarantine actions reported a |
Linux
Reference | Resolution |
|---|---|
SEC-213328 | Resolves an issue where the Trellix EDR Client displayed a |
Known issues
For a list of known issues in this product release, see KB91275.
Installation information
The Trellix Endpoint Detection and Response Installation Guide provides information for installing the product and migrating from Trellix® Active Response.