CVE-2026-16172— Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash
Quick assessment
Affected
Netskope Endpoint DLP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netskope Endpoint DLP是Netskope公司的一款终端数据防泄漏软件。 Netskope Endpoint DLP 141.0之前版本存在缓冲区错误漏洞，该漏洞源于Endpoint DLP服务存在堆越界读取，未能通过边界检查正确验证特制消息，本地标准用户可能发送此类消息导致内核驱动程序处理程序崩溃，成功利用可能导致EPDLP服务崩溃并暂时中断DLP执行，还可能向未授权用户泄露每次启动的内存布局信息。
Possible ATT&CK Techniques 3 AI
T1059.001 · PowerShell T1562.002 T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Netskope | Endpoint DLP | < 141.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16172
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash
Source: CVE Program / CVE List V5
Vulnerability Description
Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful exploitation could potentially crash the EPDLP service, temporarily interrupting DLP enforcement. A successful exploit could potentially also reveal per-boot memory layout information to unauthorized users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Netskope Endpoint DLP 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Netskope Endpoint DLP是Netskope公司的一款终端数据防泄漏软件。 Netskope Endpoint DLP 141.0之前版本存在缓冲区错误漏洞，该漏洞源于Endpoint DLP服务存在堆越界读取，未能通过边界检查正确验证特制消息，本地标准用户可能发送此类消息导致内核驱动程序处理程序崩溃，成功利用可能导致EPDLP服务崩溃并暂时中断DLP执行，还可能向未授权用户泄露每次启动的内存布局信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Netskope | Endpoint DLP | 0 ~ 141.0 | - |
|
II. Public POCs for CVE-2026-16172
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16172
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16172 (1)
-
🔗 Log in | Netskope Support Portal vendor-advisory
IV. Related Vulnerabilities
Same vendor: Netskope
-
CVE-2026-15710
Netskope Client Endpoint DLP Kernel Driver Information Leaka -
CVE-2026-16174
Netskope Endpoint DLP Driver Integer Overflow Leading to Ker -
CVE-2025-15642
Netskope Client Service Insufficient Access Controls -
CVE-2025-15641
Netskope Client Exposed IOCTL with Insufficient Access Contr -
CVE-2026-2810
Endpoint DLP Driver Out-of-Bounds Read
Same weakness: CWE-125
-
CVE-2026-117557
SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read -
CVE-2026-117556
zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface -
CVE-2026-107472
Out-of-bounds read vulnerability in QTextCodec TSCII encodin -
CVE-2026-105946
Out-of-bounds read vulnerability in NTLM authentication hand -
CVE-2026-116841
DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmp