Netskope Endpoint DLP EUVD-2026-75879

Exploitation requires an authenticated local user account with at least standard (non-admin) privilege on an endpoint where the Netskope Client with Endpoint DLP is installed and actively running. The attacker must be able to send IPC messages to the EPDLP kernel driver service from user space. Remote unauthenticated exploitation is not possible; the attack is strictly local. The memory layout disclosure is bounded to per-boot kernel address information, which is only useful if the attacker subsequently seeks to chain it with another local kernel vulnerability requiring ASLR bypass.

The CVSS 4.0 score of 6.0 is broadly reasonable for this flaw. The local attack vector (AV:L) and requirement for a standard (low-privilege) local user account (PR:L) are the primary risk limiters - remote exploitation is not possible, and anonymous network access is irrelevant. The SA:H metric captures the kernel driver crash accurately, as that component operates in a privileged ring separate from the EPDLP user-space service. EPSS data is not provided; given the niche product footprint and local-only prerequisite, real-world mass exploitation is unlikely. The memory layout leak is the more concerning secondary primitive: while the crash-induced DoS is recoverable (DLP temporarily offline), the ASLR bypass primitive could be chained with a separate write primitive in a multi-stage local privilege escalation attack. A security team - even at a mid-sized enterprise deployment in kielce where Netskope Client is centrally managed - should treat this as a scheduled patch rather than an emergency, prioritising environments where insider threat or shared-workstation scenarios elevate the risk of local attackers. No KEV listing and no public PoC have been identified, reducing urgency. The vendor advisory rating is consistent with the CVSS 4.0 assessment.

A local user with a standard domain account on a Netskope-protected Windows endpoint sends a specially crafted inter-process message to the EPDLP kernel driver without administrative privileges. The driver reads beyond the message buffer boundary, triggering a crash that briefly disables DLP enforcement; simultaneously, the leaked heap data reveals kernel base addresses. No public exploit code exists, but the technique is a standard local kernel interaction primitive requiring only a user-mode account.