CVE-2025-5942: Heap Overflow in Netskope Endpoint DLP Driver

Severity: medium (CVSS 5.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-14 · updated 2026-06-17
Weakness: CWE-122

Description

Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, an unprivileged user can trigger a heap overflow in the epdlpdrv.sys driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation can also potentially be performed by an unprivileged user whose NS Client is configured to use Endpoint DLP. A successful exploit can result in a denial-of-service for the local machine.

Affected products

Netskope Client: before 126.0.9, 129.0.0 — fixed in 129.0.0, 126.0.9

How to fix

Upgrade to a fixed version: Netskope Client 129.0.0, 126.0.9. Check the vendor advisory for mitigations.

References

https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-003

Get alerted when CVE-2025-5942 or the next vulnerability affects your stack