CVE-2026-15710
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, and a reply buffer was not properly initialized before returning data, leaking residual kernel pool memory.
Risk Assessment
A local unprivileged attacker can enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.
Recommendation
Upgrade Netskope Client for Windows to version R141 or later to fix the lack of message validation and buffer initialization.
Other vulnerabilities in Netskope Client for Windows
Original NVD description (English source)
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS