EUVD-2026-76108
GHSA-5gwh-rfcj-mvh7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local unprivileged access required; scope changed to reflect kernel memory leakage crossing into other users' security contexts; no integrity or availability impact.
Primary rating from Vendor (Netskope).
CVSS VectorVendor: Netskope
Lifecycle Timeline
3DescriptionCVE.org
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.
AnalysisAI
The Endpoint DLP kernel driver (epdlpdrv.sys) in Netskope Client for Windows before release R141 exposes two overlapping flaws: an absent token-validation check on the internal kernel-to-userspace IPC channel, and an uninitialized reply buffer in the port message handler that returns residual kernel pool contents to callers. Any local unprivileged process can send unauthorized queries to the driver port without proving it is the legitimate hook DLL, then read uninitialized response buffers to extract DLP configuration data, feature flags, live session tokens, and kernel memory fragments from other users' concurrent operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution under any standard (non-administrative) Windows user account on a system where the Netskope Client Endpoint DLP component is installed and the epdlpdrv.sys driver is loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 with AV:L/PR:L accurately reflects the exploitation surface - a local unprivileged process is required, ruling out unauthenticated remote exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Netskope Client for Windows to release R141 or later, which introduces token-based validation on the IPC port and initializes reply buffers before returning data to callers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious p
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious no
Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged lo
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token
The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start variou
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts
Anti-tampering bypass in Netskope Client for Windows (all versions prior to R138) allows a local administrator to send c
Tamper Protection bypass in Netskope Client for Windows allows a malicious local administrator to disable or subvert the
Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.
Netskope's Endpoint DLP Module for Windows is vulnerable to an integer overflow in its DLL Injector that can be triggere
Out-of-bounds heap read in Netskope Client's Endpoint DLP (EPDLP) service allows a local unprivileged user to crash the
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today