Microsoft CVE-2026-3991

The vulnerability stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), indicating the DLP Windows endpoint agent may load or execute code from locations controllable by lower-privileged users. This class of vulnerability commonly manifests through unquoted service paths, insecure directory permissions allowing DLL planting, or loading configuration/plugins from user-writable locations. The Symantec/Broadcom DLP Windows Endpoint runs with elevated privileges to monitor data exfiltration attempts across applications, clipboard operations, and network traffic. The affected CPE (cpe:2.3:a:broadcom:data_loss_prevention) covers the Windows endpoint agent component specifically, which operates as a kernel-mode driver and user-mode service. When such agents trust user-controlled paths or fail to validate code integrity, authenticated users can inject malicious libraries or executables that inherit the agent's SYSTEM context. The 'Information Disclosure' and 'Microsoft' tags suggest this may also expose sensitive DLP policy configurations or monitored data during the privilege escalation process.