Netskope Client EUVD-2026-76108

Exploitation requires local code execution under any standard (non-administrative) Windows user account on a system where the Netskope Client Endpoint DLP component is installed and the epdlpdrv.sys driver is loaded. No elevated privileges, no administrator rights, and no special non-default configuration are required beyond the Endpoint DLP feature being active. The attack surface is entirely local - the driver IPC port is not reachable remotely, so exploitation is bounded by the requirement for prior local access to the endpoint. Exploitation is further limited to Windows platform deployments; no Linux or macOS variants are implicated. The uninitialized buffer disclosure requires a victim user to have recently performed operations that left residual data in the targeted kernel pool region, introducing a minor timing dependency.

The CVSS 4.0 score of 6.8 with AV:L/PR:L accurately reflects the exploitation surface - a local unprivileged process is required, ruling out unauthenticated remote exploitation. Despite the moderate score, the practical impact is disproportionately significant: live session tokens extracted from kernel IPC replies could allow an attacker to impersonate another user's Netskope DLP session, effectively bypassing the data controls the product is deployed to enforce. Even a mid-sized municipal IT team in gdynia relying on Netskope for regulatory compliance should treat this as an urgent remediation item, since successful exploitation undermines the product's own security guarantees. The SC:L component in the CVSS 4.0 vector confirms cross-user impact, consistent with the description's mention of kernel memory from other users' operations. No KEV listing and no public POC reduce near-term automated exploitation risk, but the detailed public description provides sufficient technical specificity for local exploit development by a capable attacker.

A local attacker holding a standard Windows user account on an endpoint running Netskope Client crafts messages targeting the epdlpdrv.sys kernel port, bypassing the absent token check to enumerate DLP policy configuration. The attacker then reads uninitialized reply buffers to recover residual kernel pool contents, potentially capturing session tokens previously written into that memory region by other users' concurrent DLP operations. With a harvested session token, the attacker can impersonate another user's Netskope session or extract monitored keyword lists and data classification rules that reveal what sensitive data the organization is trying to protect.