CVE-2026-16174

Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow

Published Sep 10, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled. A successful exploit could potentially result in a denial-of-service, arbitrary code execution, or privilege escalation on the local machine.

Analysis

Technical impact

A kernel pool overflow can arise when an integer overflow is triggered by a crafted message sent to the Netskope Endpoint DLP Driver’s process port. The overflow corrupts memory, potentially allowing a local attacker to cause a denial‑of‑service, execute arbitrary code, or elevate privileges on the host. The flaw fundamentally stems from CWE‑190, an integer overflow that can be abused when input is unchecked.

Affected Systems

The vulnerability targets Windows systems running the Netskope Endpoint DLP client with the EPDLP module enabled. It requires the Windows Memory Integrity (Hypervisor‑Protected Code Integrity) feature to be disabled, and the EPDLP service must be active and listening for messages. Any device that has installed the Netskope client with DLP enabled and Memory Integrity turned off is susceptible.

Risk and Exploitability

The CVSS score of 8.7 marks this as a high‑severity flaw. EPSS is not available and the issue is not listed in KEV, yet the need for a local privileged user to send a crafted message makes the attack vector local. Because Memory Integrity is a defensive technology, turning it off substantially increases the likelihood that the kernel pool overflow will succeed, raising the practical risk for organizations that have not enabled this feature or who have not patched the client.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Netskope

Endpoint DLP

unaffected

Version	Status	Constraints
`0`	affected	< 141.0

No data.

Vendor Product Versions

Netskope

Endpoint Dlp

Version	Status	Scheme	Platform
`[0,141.0)`	affected	generic	['windows']

Remediation

Vendor Workaround

Ensure that Hypervisor-Protected Code Integrity (HPCI), also known as Memory Integrity, is enabled in Windows.

OpenCVE Recommended Actions

Enable Hypervisor‑Protected Code Integrity (Memory Integrity) in Windows settings to prevent the driver from executing unchecked integer operations.
Upgrade the Netskope Endpoint DLP client to the latest release that fixes the integer‑overflow bug; check the vendor’s advisory for the specific patch version.
If the DLP function is not required on a particular device, disable or uninstall the EPDLP module so that the vulnerable driver is removed from the system.

Generated by OpenCVE AI on September 11, 2026 at 03:53 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.175% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-Endpoint-DLP-Security-Notice---NSKPSA-2026-010

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Netskope Netskope endpoint Dlp
Vendors & Products		Netskope Netskope endpoint Dlp

Sep 11, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 10, 2026 11:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled. A successful exploit could potentially result in a denial-of-service, arbitrary code execution, or privilege escalation on the local machine.
Title		Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
Weaknesses		CWE-190
References		https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-Endpoint-DLP-Security-Notice---NSKPSA-2026-010
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`