CVE-2026-16172

Executive Summary

CVE-2026-16172 is an out-of-bounds heap read (CWE-125) in the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user can send a specially crafted message that lacks proper bounds validation, potentially crashing the kernel driver handler and the EPDLP service itself. Impact includes temporary interruption of DLP enforcement and potential disclosure of per-boot memory layout information (an ASLR-bypass primitive) to unprivileged local users.

Technical Analysis

The vulnerability class is an out-of-bounds heap read affecting a kernel-level driver handler that services the Endpoint DLP component of the Netskope Client. Per the NVD description, a local standard (unprivileged) user can send a "specially crafted message that is not properly validated with a bounds check." The absence of a bounds check on a message processed by the kernel driver handler means the code reads beyond the intended boundary of a heap-allocated buffer.

Two distinct impacts are described:

1. Availability/Robustness: The malformed message "likely crashes the kernel driver handler," which in turn "could potentially crash the EPDLP service, temporarily interrupting DLP enforcement."
2. Information Disclosure: "A successful exploit could potentially also reveal per-boot memory layout information to unauthorized users."

The second point is significant. Per-boot memory layout information (e.g., pointer values or structures reflecting the kernel/process address-space layout for the current boot) is a classic building block for defeating memory randomization (ASLR/KASLR). While CVE-2026-16172 itself does not provide code execution, its information-disclosure primitive can serve as a reconnaissance stage for chaining with a separate memory-corruption vulnerability.

No CVSS vector, score, or affected version range was published with this record. The score and vector in METADATA are analyst-inferred from the described characteristics (local, low complexity, low privileges, no user interaction, low confidentiality and availability impact) and must not be treated as vendor-assigned values. No public PoC, exploit code, or Nuclei template exists. CISA KEV status: NO. EPSS: not yet scored by FIRST.org.

No function names, message formats, IOCTL codes, or file paths are referenced in the available description; implementation-level detail is unavailable. Analysis is therefore constrained to the vulnerability class and its described effects.

Exploitation Scenarios

Because no public PoC exists, this attack chain is inferred from the vulnerability class (out-of-bounds heap read in a locally reachable kernel driver handler) and the explicit impacts stated in the NVD description.

1. Reconnaissance / target identification. The attacker requires local access to a host running the Netskope Client with the Endpoint DLP (EPDLP) service active. The target is the kernel driver handler that receives messages destined for EPDLP. The attacker identifies the message-passing interface exposed to standard users (the description confirms a standard user can reach it).

2. Triggering the flaw. The attacker sends "a specially crafted message" to the driver handler. The message is "not properly validated with a bounds check," so the handler reads past the end of a heap buffer. The specific message structure, field, or length value that induces the over-read is not described in available data and cannot be specified here without fabrication.

3. Payload / execution method. No payload code execution is described. The exploitation primitive is a malformed message plus repetition/tuning to control how far past the buffer boundary the read travels. The attacker's objective at this stage is either (a) forcing the kernel driver handler to fault and crash, or (b) capturing the out-of-bounds read result to leak per-boot memory layout information.

4. Post-exploitation impact. On the availability path, the crash of the kernel driver handler can crash the EPDLP service, "temporarily interrupting DLP enforcement" — a window in which data-exfiltration controls on the endpoint are degraded. On the disclosure path, the leaked per-boot memory layout information is useful for bypassing memory randomization and can be leveraged as a stepping stone toward a more severe exploit (e.g., chaining with a write primitive) if one exists. The record does not claim code execution or privilege escalation as an outcome of this CVE alone.

Impact Assessment

Exploitation requires local access and standard-user privileges; no authentication or user interaction beyond that is described. Primary impact is on availability (crash of the EPDLP service, interrupting endpoint DLP enforcement) and confidentiality (disclosure of per-boot memory layout information). No integrity impact is described.

Blast radius: All endpoints running the affected Netskope Client with the EPDLP service. Because no affected version range was published, the full install base must be treated as potentially exposed until the vendor clarifies. The per-boot memory-layout disclosure is confined to the local host and the current boot session, but its value to an attacker is that it can enable follow-on exploitation. The DLP-enforcement interruption is the operationally significant risk for enterprises: an endpoint can be slipped out of policy enforcement for the duration of the service outage.

CVSS subscores (analyst-inferred, not vendor-published): Attack Vector Local (AV:L), Attack Complexity Low (AC:L), Privileges Required Low (PR:L), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality Low (C:L), Integrity None (I:N), Availability Low (A:L). Given no official score, treat this as a qualitative descriptor only.

Detection Guidance

Sigma Rule

title: Potential Netskope EPDLP Out-of-Bounds Heap Read Exploitation Attempt
id: 8f3a1c62-4d5e-4b7a-9c21-0a7e6b1d4f88
status: experimental
description: Detects abnormal process crashes of the Netskope EPDLP service or kernel driver handler consistent with CVE-2026-16172 out-of-bounds heap read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-16172
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.16172
logsource:
  product: windows
  service: system
detection:
  selection_service:
    Provider_Name: 'Service Control Manager'
    EventID: 7031
    param1|contains: 'Netskope'
  selection_appcrash:
    Provider_Name: 'Application Error'
    EventID: 1000
    param1|contains:
      - 'epdlp'
      - 'netskope'
  selection_kernel:
    Provider_Name: 'Microsoft-Windows-Kernel-PnP'
    EventID: 219
  condition: 1 of selection_*
falsepositives:
  - Legitimate Netskope Client upgrades or service restarts
  - Unrelated application crashes on the same endpoint
level: medium

YARA Rule

rule CVE_2026_16172_Netskope_EPDLP_OOB_Read_Artifact
{
    meta:
        author = "valtersit.com"
        description = "Placeholder detection for artifacts/strings associated with Netskope EPDLP OOB heap read exploitation attempts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16172"
        date = "2026-01-01"
        cve = "CVE-2026-16172"
    strings:
        $epdlp = "EPDLP" ascii wide nocase
        $netskope = "Netskope" ascii wide nocase
        $svc = "netskope" ascii wide nocase
    condition:
        any of ($epdlp, $svc) and $netskope
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-16172 Netskope Client EPDLP possible OOB heap read exploitation attempt (local interface)"; flow:to_server,established; content:"Netskope"; nocase; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-16172; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-16172; sid:202616172; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

process where host.os.type == "windows" and
event.category == "process" and event.type == "start" and
process.name : ("epdlp.exe", "netskope*.exe", "stAgent*.exe") and
process.parent.name : ("services.exe", "svchost.exe")

Splunk SPL Query

index=wineventlog (EventCode=1000 OR EventCode=7031 OR EventCode=7034)
| search (Message="*epdlp*" OR Message="*netskope*" OR param1="*Netskope*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, EventCode, Message
| where count > 1
| eval severity="Potential CVE-2026-16172 EPDLP crash/recovery"
| table first_seen last_seen host EventCode count severity

Wazuh OSSEC Rule

<group name="netskope,cve-2026-16172,">
  <rule id="100161" level="10">
    <if_sid>60000</if_sid>
    <match>epdlp</match>
    <match>crash</match>
    <description>CVE-2026-16172: Possible Netskope EPDLP service crash (out-of-bounds heap read) on $(hostname)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix or affected-version data was published with this record.

1. Immediate mitigations: Restrict local interactive access to managed endpoints (limit who can log on). Deploy EDR tamper protection and monitor for local user processes that spawn unexpectedly or attempt to interact with the Netskope EPDLP driver. Configure the endpoint agent to auto-restart the EPDLP service so DLP enforcement interruptions are minimized. If feasible, coordinate with Netskope to determine whether the EPDLP driver can be constrained via driver-signing/attack-surface-reduction policies.

2. Patch/upgrade steps: No patched version is available. Contact Netskope support for a fixed client/driver build and guidance on affected versions; monitor the Netskope security advisory channel and the NVD entry for the official fix reference. Apply the vendor-provided update as soon as it is published and consistent with change-control procedures.

3. Long-term hardening: Enforce least-privilege for local users; limit local logon rights to the minimum required. Ensure endpoint memory protections (KASLR/ASLR) remain enabled. Track per-boot memory-disclosure CVEs as chain components and prioritize them alongside higher-severity memory-corruption bugs. Maintain centralized crash telemetry for the Netskope agent to detect exploitation attempts and service-interruption windows. Establish a standing process for validating vendor advisories against internal asset inventories given the currently missing affected-version data.

References

• NVD — CVE-2026-16172: https://nvd.nist.gov/vuln/detail/CVE-2026-16172
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• Netskope Security Advisories: https://www.netskope.com/company/security-compliance-and-assurance
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or in-the-wild exploitation evidence is available for this CVE; no public PoC or exploit code has been observed.