A local elevation of privilege vulnerability in Symantec Data Loss Prevention Windows Endpoint poses a significant risk of unauthorized resource access for affected systems.

This vulnerability involves the inclusion of functionality from an untrusted control sphere (CWE-829), which can be exploited by an authenticated local user with low privileges to escalate their access level.

Successful exploitation of this vulnerability allows an attacker to bypass standard security restrictions and gain elevated privileges on the host machine. Given the CVSS score of 7.8, this flaw represents a High severity risk, potentially facilitating full system compromise, unauthorized data access, or the deployment of additional malicious payloads within the enterprise environment.

Immediate Action: Update the Symantec Data Loss Prevention Windows Endpoint software to version 25.1.00100.60229, 16.1.00200.60431, 16.0.20009.60689, 16.0.10112.60928, or later, as specified in the Broadcom security advisory.

Proactive Monitoring: Review system access logs for anomalous behavior or unexpected process execution patterns originating from low-privileged user accounts.

Compensating Controls: Ensure robust endpoint security policies are in place to restrict local user execution permissions and employ principle of least privilege to minimize the potential impact of an escalation attempt.

Public Exploit Available: No

Organizations utilizing Symantec Data Loss Prevention on Windows endpoints must treat this vulnerability with high priority. Administrators should plan for an immediate deployment of the provided vendor patches to prevent local privilege escalation and subsequent system compromise. Failure to update may allow malicious actors to exploit the software to gain unauthorized administrative-level control over protected endpoint resources.