Read the docs
TI-2026-13525 Aliases CVE-2026-16174GHSA-jhw5-fjmq-266w

Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow

Priority LOW 39CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled. A successful exploit could potentially result in a denial-of-service, arbitrary code execution, or privilege escalation on the local machine.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed Endpoint DLP (Netskope): 141.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetskopeEndpoint DLPbefore 141.0141.0Patch availableCNA
  • Endpoint DLP VendorNetskope Affected before 141.0 Fixed in 141.0 Patch available CNA

Remediation

  • Fix · CNA Endpoint DLP (Netskope) Fixed in 141.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Netskope Endpoint DLP 141.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-13524 Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process CrashPriority LOW 26
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16174
  2. 2026-10-03 Alias added: GHSA-jhw5-fjmq-266w

References

Advisory 1

  • TI-2020-15056 Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. CVSS 3.1HIGH 8.8
  • TI-2024-06860 Client Enrollment Process Bypass CVSS 4.0HIGH 8.5
  • TI-2023-04599 Local privilege escalation in Netskope Client CVSS 3.1HIGH 8.8
  • TI-2021-20302 Sensitive Information store in NSClient logs CVSS 3.1HIGH 8.4
  • TI-2023-02129 Local privilege escalation in Netskope Client CVSS 3.1HIGH 7.8
  • TI-2020-17407 A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an… CVSS 3.1HIGH 7.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences