EUVD-2026-26239Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because exploitation is strictly local; AC:H reflects the non-default prerequisite that the DLP module must be enabled; PR:L for unprivileged OS session; impact is availability-only via BSOD.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an out-of-bounds read within a driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.
AnalysisAI
Local denial-of-service in Netskope Client's Endpoint DLP Module on Windows allows an unprivileged local user to crash the operating system via a kernel-level out-of-bounds read in a driver, producing a Blue-Screen-of-Death. Exploitation requires the Endpoint DLP module to be active in the client configuration, limiting the exposed population to deployments where that feature is intentionally enabled. No public exploit code exists and no active exploitation has been identified; EPSS is 0.01% and SSVC rates exploitation as none, consistent with the local-only attack vector.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a memory-safety defect where a program reads data beyond the boundary of an allocated buffer. Here the flaw resides inside a kernel-mode Windows driver shipped as part of the Netskope Client Endpoint DLP Module. Kernel drivers operate at ring-0 privilege; an out-of-bounds read at that level typically cannot be caught by user-space error handlers and instead propagates as a fatal system exception, triggering Windows' bugcheck mechanism (BSOD). The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) confirms the attacker interacts with the driver from low-privilege user space - likely through an IOCTL or named device interface - while the AT:P flag indicates a specific precondition (DLP module enabled) must be met. Affected client versions span multiple release branches: below 129.1.8, 132.0.23, 135.1.0, and 136.1 per ENISA EUVD-2026-26239.
RemediationAI
Upgrade Netskope Client to the patched releases across the applicable branch - 129.1.8, 132.0.23, 135.1.0, or 136.1 (or later) - per vendor advisory NSKPSA-2026-002 at https://support.netskope.com/s/article/Netskope-Security-Advisory-NSKPSA-2026-002-Netskope-Endpoint-DLP-Driver-Security-Advisory. Where immediate patching is operationally blocked, disabling the Endpoint DLP module in the Netskope client policy configuration eliminates the vulnerable code path entirely; the trade-off is full loss of endpoint data loss prevention enforcement, which may violate compliance requirements. Restricting local interactive or remote desktop access to endpoints running unpatched clients provides partial compensating control, since the attack requires local low-privilege access, but does not eliminate risk for shared workstations or systems accessible to multiple users. Prioritize patching on multi-user Windows endpoints and VDI environments.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today