Netskope Client and Endpoint DLP
CVE-2026-16174: Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Endpoint DLP (Windows) 0 | 141.0 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled. A successful exploit could potentially result in a denial-of-service, arbitrary code execution, or privilege escalation on the local machine.
Workarounds
Ensure that Hypervisor-Protected Code Integrity (HPCI), also known as Memory Integrity, is enabled in Windows.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.