CVE-2025-15584

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15584", "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "state": "PUBLISHED", "assignerShortName": "Netskope", "dateReserved": "2026-02-18T22:27:08.617Z", "datePublished": "2026-03-17T18:55:59.156Z", "dateUpdated": "2026-03-18T14:04:02.449Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "shortName": "Netskope", "dateUpdated": "2026-03-17T18:55:59.156Z"}, "title": "Endpoint DLP Driver Filter Communication Port Integer Overflow", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}], "affected": [{"vendor": "Netskope", "product": "Endpoint DLP Module for Netskope Client", "versions": [{"status": "affected", "version": "0", "lessThan": "135.0.0", "versionType": "custom"}], "defaultStatus": "unaffected", "platforms": ["Windows"]}], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.&nbsp;<br>"}]}], "references": [{"url": "https://support.netskope.com/s/article/NSKPSA-2025-006-Endpoint-DLP-Driver-Filter-Communication-Port-Integer-Overflow", "tags": ["vendor-advisory", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "Requires the Endpoint DLP module to be enabled in the client configuration.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Requires the Endpoint DLP module to be enabled in the client configuration."}]}], "workarounds": [{"lang": "en", "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect the behaviors associated with exploiting this vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect the behaviors associated with exploiting this vulnerability."}]}], "credits": [{"lang": "en", "value": "Tom Brice", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T14:03:46.576435Z", "id": "CVE-2025-15584", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T14:04:02.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15584", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T14:03:46.576435Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T14:03:58.794Z"}}], "cna": {"title": "Endpoint DLP Driver Filter Communication Port Integer Overflow", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Tom Brice"}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Netskope", "product": "Endpoint DLP Module for Netskope Client", "versions": [{"status": "affected", "version": "0", "lessThan": "135.0.0", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.netskope.com/s/article/NSKPSA-2025-006-Endpoint-DLP-Driver-Filter-Communication-Port-Integer-Overflow", "tags": ["vendor-advisory", "permissions-required"]}], "workarounds": [{"lang": "en", "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect the behaviors associated with exploiting this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "There are no direct workarounds. Some AV and EDR solutions may be able to detect the behaviors associated with exploiting this vulnerability.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.", "supportingMedia": [{"type": "text/html", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.&nbsp;<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound"}]}], "configurations": [{"lang": "en", "value": "Requires the Endpoint DLP module to be enabled in the client configuration.", "supportingMedia": [{"type": "text/html", "value": "Requires the Endpoint DLP module to be enabled in the client configuration.", "base64": false}]}], "providerMetadata": {"orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "shortName": "Netskope", "dateUpdated": "2026-03-17T18:55:59.156Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15584", "state": "PUBLISHED", "dateUpdated": "2026-03-18T14:04:02.449Z", "dateReserved": "2026-02-18T22:27:08.617Z", "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc", "datePublished": "2026-03-17T18:55:59.156Z", "assignerShortName": "Netskope"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Endpoint DLP Module for Netskope Client", "vendor": "Netskope", "versions": [{"lessThan": "135.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@netskope.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine."}, {"lang": "es", "value": "Netskope fue notificado sobre una posible brecha en su M\u00f3dulo DLP de Endpoint para el Cliente Netskope en sistemas Windows. La explotaci\u00f3n exitosa de la brecha puede potencialmente permitir a un usuario sin privilegios desencadenar un desbordamiento de entero dentro del puerto de comunicaci\u00f3n del filtro, lo que lleva a una Pantalla Azul de la Muerte (BSOD). La explotaci\u00f3n exitosa requerir\u00eda que el m\u00f3dulo DLP de Endpoint est\u00e9 habilitado en la configuraci\u00f3n del cliente. Un exploit exitoso puede potencialmente resultar en una denegaci\u00f3n de servicio para la m\u00e1quina local."}], "id": "CVE-2025-15584", "lastModified": "2026-06-17T08:38:04.753", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@netskope.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15584", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T14:03:46.576435Z", "version": "2.0.3"}}]}, "published": "2026-03-17T20:16:10.503", "references": [{"source": "psirt@netskope.com", "url": "https://support.netskope.com/s/article/NSKPSA-2025-006-Endpoint-DLP-Driver-Filter-Communication-Port-Integer-Overflow"}], "sourceIdentifier": "psirt@netskope.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "psirt@netskope.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,135.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Endpoint DLP Module for Netskope Client", "source": "cna", "vendor": "Netskope"}, "product": "endpoint_dlp_module_for_netskope_client", "vendor": "netskope"}], "analysis": {"en": {"generated_at": "2026-03-17T20:20:44.018653+00:00", "value": {"mitigation_remediation": ["Verify whether Netskope has released an update or patch for the Endpoint DLP Module and apply it immediately (vendor advisory).", "If a patch is not yet available, consider disabling the Endpoint DLP Module in the client configuration to prevent the overflow from being exercised.", "Deploy antivirus and EDR solutions that can detect exploitation behaviors associated with this vulnerability, as the vendor notes that some security solutions may identify related activity.", "Continuously monitor the system for BSOD events and investigate any incidents promptly."], "summary": {"action": "Patch", "impact": "Denial of Service (Blue\u2011Screen\u2011of\u2011Death)"}, "threat_synthesis": {"affected_systems": "Affected systems include the Netskope Endpoint DLP Module for the Netskope Client on Windows. Specific version information is not provided in the vendor data; therefore, all installed versions of the module may be potentially impacted until the vendor releases a patch.", "description_and_impact": "Netskope\u2019s Endpoint DLP Module for the Netskope Client on Windows contains an integer\u2011overflow bug in the filter communication port. When triggered by an unprivileged user, the overflow can cause the system to crash with a Blue\u2011Screen\u2011of\u2011Death, resulting in a denial\u2011of\u2011service for the local machine. The weakness is classified as CWE\u2011190 (Integer Overflow or Wraparound).", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.8, indicating moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog. The expected attack vector is a local user with unprivileged rights who can execute code on the target machine to trigger the integer overflow, leading to a BSOD. Given the lack of a publicly available exploit and the local nature of the attack, the likelihood of widespread exploitation is moderate but not negligible."}}}}, "created": "2026-03-18T10:42:58.176674+00:00", "updated": "2026-03-24T10:54:47.542790+00:00", "vendors": ["netskope", "netskope$PRODUCT$endpoint_dlp_module_for_netskope_client"]}