Read the docs
TI-2024-10763 Aliases CVE-2024-11616GHSA-368q-3gfm-fh6f

Double-fetch heap overflow

Priority LOW 25CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vulnerability arises from the fact that the NumberOfBytes argument to ExAllocatePoolWithTag, and the Length argument for RtlCopyMemory, both independently dereference their value from the user supplied input buffer inside the EpdlpSetUsbAction function, known as a double-fetch. If this length value grows to a higher value in between these two calls, it will result in the RtlCopyMemory call copying user-supplied memory contents outside the range of the allocated buffer, resulting in a heap overflow. A malicious attacker will need admin privileges to exploit the issue. This issue affects Endpoint DLP version below R119.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetskopeEndpoint DLP118.0.0; 0—No fix listedCNA
  • Endpoint DLP VendorNetskope Affected 118.0.0; 0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11616
  2. 2026-10-03 Alias added: GHSA-368q-3gfm-fh6f

References

Advisory 2

  • TI-2020-15056 Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. CVSS 3.1HIGH 8.8
  • TI-2026-13525 Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow CVSS 4.0HIGH 8.7
  • TI-2024-06860 Client Enrollment Process Bypass CVSS 4.0HIGH 8.5
  • TI-2023-04599 Local privilege escalation in Netskope Client CVSS 3.1HIGH 8.8
  • TI-2021-20302 Sensitive Information store in NSClient logs CVSS 3.1HIGH 8.4
  • TI-2023-02129 Local privilege escalation in Netskope Client CVSS 3.1HIGH 7.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences