A high-severity memory corruption vulnerability in Netskope Endpoint DLP for Windows could allow a privileged local user to achieve arbitrary code execution or system escalation.

This vulnerability is an integer overflow (CWE-190) occurring within the Netskope Endpoint DLP process port. It requires the attacker to possess high privileges on the local machine, have the EPDLP module enabled, and have Windows Memory Integrity disabled to successfully execute the attack.

The potential for arbitrary code execution and privilege escalation poses a significant risk to organizational endpoints. Successful exploitation could allow an attacker to gain full control over affected machines, leading to unauthorized data access, lateral movement within the network, or complete system compromise. The CVSS score of 8.7 confirms the high severity of this flaw, necessitating prompt attention despite the requirement for local privileged access.

Immediate Action: Update the Netskope Endpoint DLP client to version 141.0 or later immediately to resolve the memory overflow vulnerability.

Proactive Monitoring: Monitor endpoint logs for suspicious activity targeting the EPDLP process port or abnormal memory utilization patterns.

Compensating Controls: Ensure that Windows Memory Integrity is enabled across all endpoints to provide a critical layer of defense against memory corruption attacks.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for full system compromise, IT administrators should prioritize the deployment of the 141.0 update to all Windows endpoints running the Netskope Endpoint DLP module. Organizations should verify that Windows Memory Integrity is active, as this serves as a critical defense-in-depth measure against this class of memory-based vulnerabilities. Regular patch management cycles for security agents are essential to maintaining a hardened security posture.