High severity · published Sep 10, 2026
CVE-2026-16174
Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) running on Windows systems. Successful exploitation of the gap could potentially allow a privileged user to send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. Successful exploitation would require the EPDLP module to be enabled in the client configuration, and that Memory Integrity is disabled. A successful exploit could potentially result in a denial-of-service, arbitrary code execution, or privilege escalation on the local machine.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Endpoint DLP · Netskope
before 141.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16174
support.netskope.com
https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-Endpoint-DLP-Security-Notice---NSKPSA-2026-010
More from Endpoint DLP
6.8
CVE-2026-15710
Netskope Client Endpoint DLP Kernel Driver Information Leakage
6.0
CVE-2026-16172
Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash
