Vulnerability Spotlight: Symantec Endpoint Protection kernel memory information disclosure vulnerability

Summary: Marcin Noga of Cisco Talos discovered an information leak vulnerability in the ccSetx86.sys kernel driver of Symantec Endpoint Protection Small Business Edition, located in the IOCTL handler for the 0x224844 control code in driver version 16.0.0.77. An unprivileged user can send specially crafted IOCTL requests to the ccSet_{F7A725B7-8267-494C-9647-F4FC1D53C6A3} device, which by default allows any user on the system, to make the driver return uninitialized kernel memory that may contain privileged tokens or kernel memory addresses usable to bypass kernel security mitigations.
What's compelling: The device's default access control lets any user on the system send these requests, so the leak requires no elevated privileges to trigger. Kernel memory addresses exposed this way can be used to bypass kernel security mitigations, and Talos worked with Symantec to ensure a patch is available.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-18366
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026