Exploitation for Priv-Esc × Broadcom (Symantec) Symantec Data Loss Prevention for Windows

A stack-based buffer overflow vulnerability in Symantec Data Loss Prevention for Windows allows unauthenticated remote code execution.

Stack-based buffer overflow in the WP6SR DLL of Symantec DLP for Windows. An attacker crafts a malicious document; when opened by a user, it triggers the overflow, enabling arbitrary code execution with no authentication required. Defeats the DLP endpoint agent's integrity, potentially allowing data exfiltration or system compromise.

Monitor for unexpected child processes spawned by the Symantec DLP agent process (e.g., cmd.exe, powershell.exe) or anomalous network connections from it. Apply the vendor patch immediately and restrict document handling from untrusted sources.