CVE-2026-16172: Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-10 · updated 2026-09-18
Weakness: CWE-125

Description

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful exploitation could potentially crash the EPDLP service, temporarily interrupting DLP enforcement. A successful exploit could potentially also reveal per-boot memory layout information to unauthorized users.

Affected products

Netskope Endpoint DLP: before 141.0 — fixed in 141.0

How to fix

Upgrade to a fixed version: Netskope Endpoint DLP 141.0. Check the vendor advisory for mitigations.

References

https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-Endpoint-DLP-Security-Notice---NSKPSA-2026-008

Get alerted when CVE-2026-16172 or the next vulnerability affects your stack