CVE-2026-16174

Executive Summary

CVE-2026-16174 is an integer overflow (CWE-190) in the Netskope Endpoint DLP (EPDLP) client on Windows, reachable when a privileged local user sends a crafted message to the EPDLP process port. Successful exploitation can cause memory corruption and may result in denial-of-service, arbitrary code execution, or privilege escalation on the local machine. The flaw requires the EPDLP module to be enabled in client configuration and Windows Memory Integrity to be disabled; no public PoC, Nuclei template, or CVSS score is currently available, and no vendor patch has been identified.

Technical Analysis

Netskope Endpoint DLP is an endpoint agent that inspects files, clipboard, and egress channels on managed Windows hosts to enforce data-loss-prevention policy. The advisory states that a privileged user can send a crafted message to the EPDLP process port to trigger an integer overflow, leading to memory corruption. The relevant weakness class is CWE-190, Integer Overflow or Wraparound.

At the class level, an integer overflow occurs when an arithmetic operation on a size, length, counter, or index field exceeds the representable range of its integer type. In a process-port message handler, this typically means that a length or count value taken from an attacker-controlled message is used in an allocation or bounds calculation without adequate range validation. The wrapped value then no longer reflects the true size of the data, so a subsequent copy or indexing operation can write beyond the intended buffer boundary — producing the memory corruption the advisory describes. Because the flaw is reachable through a process port rather than a remote network socket, exploitation is constrained to a local context and requires the ability to send messages to that port, which the advisory characterizes as a privileged-user capability.

Two preconditions are stated explicitly and must both hold:

1. The EPDLP module must be enabled in the client configuration.
2. Windows Memory Integrity must be disabled, which removes a hardware-assisted code-integrity control (HVCI) that would otherwise constrain exploitation of memory corruption.

The advisory does not disclose the port identifier, the message format, the specific field that overflows, or the affected product versions. No CVSS vector, CWE-to-CVSS mapping, or vendor severity rating is available. Per the data provided, no function name, endpoint, parameter, or file path can be confirmed; anything beyond the process-port message vector and the integer-overflow-to-memory-corruption chain would be speculation and is therefore excluded from this report.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-16174. The attack chain below is inferred from the vulnerability class and the conditions stated in the Netskope advisory; it does not assert undocumented implementation details.

1) Reconnaissance and target identification. The attacker must first obtain local access to a Windows host running the Netskope Endpoint DLP client with the EPDLP module enabled. Because the vector is a local process port, the relevant reconnaissance is local: enumerating listening endpoints, identifying processes and named objects associated with the EPDLP service, and confirming whether the EPDLP module is active. The advisory also requires confirmation that Memory Integrity is disabled — an attacker can assess this from host configuration rather than needing remote discovery.

2) Triggering the flaw class. The attacker, operating as a privileged user, constructs a message directed at the EPDLP process port and sends it. Inside the EPDLP handler, an integer value derived from the message overflows (wraps), and because the wrapped value is subsequently used in a memory operation, the result is memory corruption. The advisory does not describe the specific message field, so the exact encoding of the trigger cannot be stated.

3) Payload and execution method. At the vulnerability-class level, the payload is a crafted process-port message, not a file or network packet. Successful exploitation depends on shaping the overflow so that the corrupted memory region is one the attacker can influence or control; both preconditions (EPDLP enabled, Memory Integrity disabled) must hold for the corruption to translate into a useful primitive.

4) Post-exploitation impact. The advisory lists three possible outcomes: denial-of-service (crashing or destabilizing the DLP agent on the host), arbitrary code execution, and privilege escalation on the local machine. Because the trigger requires privileged-user access, the most security-relevant outcome is privilege escalation or code execution in a higher-integrity security context on the same host — a classic local escalation path against an endpoint security agent. The advisory does not claim remote or cross-host impact.

Impact Assessment

The immediately affected population is Windows endpoints where the Netskope EPDLP module is enabled and Memory Integrity is disabled. Because EPDLP is a DLP enforcement agent, compromise or disruption affects both the host it runs on and the visibility the security team depends on. A denial-of-service can blind DLP monitoring for that endpoint; code execution or privilege escalation can subvert the agent's own integrity, potentially allowing an attacker to bypass DLP controls, suppress alerts, or persist in a privileged context.

Blast radius is host-local per the advisory's wording. There is no evidence of a remote, unauthenticated, or wormable vector. Exploitability is gated by two configuration preconditions and by the requirement for a privileged local user, which sharply limits opportunistic abuse and elevates the profile toward insider-threat or post-compromise escalation scenarios. No CVSS vector is published, so no subscore-based severity can be derived; analysts should not assign a score from third-party sources. EPSS has not been scored by FIRST.org, CISA KEV does not list this CVE, and no exploit-in-the-wild evidence is available. Severity should currently be treated as unresolved pending a vendor score and version disclosure.

Detection Guidance

Sigma Rule

title: Potential Netskope EPDLP Integer Overflow Exploitation (Local)
id: 8f2c1a44-7b1e-4c9a-9d3e-0c5a2b7e6f10
status: experimental
description: Detects abnormal termination or crash of the Netskope Endpoint DLP process on Windows, consistent with memory-corruption attempts against the EPDLP process port (CVE-2026-16174).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-16174
author: valtersit.com
date: 2026/01/01
tags:
  - attack.privilege-escalation
  - attack.t1068
logsource:
  product: windows
  service: application
detection:
  selection_crash:
    Provider_Name: 'Application Error'
    Message|contains:
      - 'netskope'
      - 'EPDLP'
  selection_module:
    EventID: 1000
  condition: selection_crash and selection_module
falsepositives:
  - Legitimate DLP agent upgrades or forced restarts
  - Unrelated application crashes whose message text contains 'netskope'
level: medium

YARA Rule

rule CVE_2026_16174_Netskope_EPDLP_IntegerOverflow_Artifacts
{
    meta:
        author = "valtersit.com"
        date = "2026-01-01"
        description = "Hunts for EPDLP crash dumps or memory artifacts referencing the Netskope Endpoint DLP process port handling path (CVE-2026-16174, CWE-190)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16174"
        tlp = "WHITE"

    strings:
        $epdlp1 = "EPDLP" ascii wide nocase
        $epdlp2 = "Endpoint DLP" ascii wide nocase
        $epdlp3 = "netskope" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and   // MZ header: Windows PE/dump
        filesize < 200MB and
        any of ($epdlp*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-16174 Netskope EPDLP local process-port integer overflow indicator (loopback)"; flow:to_server,established; dsize:>512; content:"EPDLP"; nocase; metadata:affected_product Netskope_Endpoint_DLP, cve CVE-2026-16174, created_at 2026_01_01; reference:cve,CVE-2026-16174; classtype:attempted-admin; sid:90016174; rev:1;)

Note: the vulnerability vector is a local process port, so no deterministic network signature exists. The rule above is a best-effort loopback heuristic and should be treated as low-fidelity.

Elastic Detection

process where event.type == "start" and
process.parent.name : ("services.exe", "netskope*") and
process.name : ("netskope*", "epdlp*")

process where event.type in ("end", "stop") and
process.name : ("netskope*", "epdlp*") and
process.exit_code != 0

Splunk SPL Query

index=windows (EventCode=1000 OR EventCode=1001)
| where match(Message, "(?i)netskope") OR match(Message, "(?i)EPDLP")
| stats count min(_time) as first_seen max(_time) as last_seen by host, Message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="windows,netskope,">
  <rule id="100674" level="10">
    <if_sid>60009</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.message">netskope|EPDLP</field>
    <description>CVE-2026-16174: Netskope Endpoint DLP process crash consistent with EPDLP process-port memory-corruption attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range has been published.

1. Immediate mitigations

• Where operationally feasible, disable the EPDLP module in client configuration on hosts that do not strictly require endpoint DLP coverage. This removes the stated precondition for exploitation but also removes DLP enforcement — accept this trade-off explicitly.
• Enable Windows Memory Integrity on all managed endpoints. The advisory states the attack requires Memory Integrity to be disabled, so enabling it is a direct compensating control against this specific chain.
• Restrict local administrative rights and monitor for anomalous privileged-user activity on DLP-managed hosts, since exploitation requires privileged local access.
• Isolate or decommission hosts that must run with Memory Integrity disabled and EPDLP enabled, and prioritize them for monitoring.

2. Patch/upgrade steps

• No patched version exists in any tracked source. Monitor Netskope's security advisory and release-notes channels and the NVD entry for an official fix and affected version range.
• When a fixed Endpoint DLP client is released, stage it via your existing endpoint management pipeline and verify the EPDLP module build after upgrade.
• Until then, do not assume any installed version is fixed.

3. Long-term hardening

• Treat endpoint security agents as privileged attack surface: baseline their listening ports and IPC objects and alert on unexpected changes.
• Standardize Memory Integrity/HVCI as a fleet-wide requirement rather than an optional setting.
• Maintain an inventory mapping which endpoints have EPDLP enabled so scoping is instant when a patch or advisory lands.
• Subscribe to vendor PSIRT feeds and re-evaluate severity as soon as a CVSS score and version data are published.

References

• NVD — CVE-2026-16174: https://nvd.nist.gov/vuln/detail/CVE-2026-16174
• Netskope Security Advisories / PSIRT: https://www.netskope.com/company/security-compliance-and-assurance (check for advisory on EPDLP integer overflow)
• CWE-190 — Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-16174 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE): https://api.first.org/data/v1/epss?cve=CVE-2026-16174

Threat actor / in-the-wild note: No public PoC, exploit code, Nuclei template, or attribution to any threat actor campaign has been identified for CVE-2026-16174. CISA KEV does not list this CVE. All detection content in this report is heuristic and derived from the vulnerability class and vendor preconditions; it is not based on observed exploitation.