{"id":"CVE-2021-31844","aliases":["EUVD-2021-18719","GHSA-88gm-mqfx-w7ch"],"status":"published","title":"Local Privilege Escalation in McAfee DLP Endpoint for Windows","description":"A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00376,"percentile":0.31984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2021-09-17T13:45:18Z","modified":"2026-06-17T03:52:20Z","products":[{"vendor":"mcafee","product":"data_loss_prevention_endpoint"},{"vendor":"mcafee,llc","product":"mcafee data loss prevention (dlp) endpoint for windows"}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10368","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31844"},{"url":"https://github.com/advisories/GHSA-88gm-mqfx-w7ch"}],"sources":{"cve":[{"id":"CVE-2021-31844","title":"Local Privilege Escalation in McAfee DLP Endpoint for Windows","description":"A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.","status":"published","published":"2021-09-17T13:45:18Z","modified":"2024-08-03T23:10:31.03Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-18719","description":"A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.","status":"published","published":"2021-09-17T13:45:18Z","modified":"2024-08-03T23:10:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:37.97373Z"}],"ghsa":[{"id":"GHSA-88gm-mqfx-w7ch","title":"A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior...","description":"A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.","status":"published","published":"2022-05-24T19:14:57Z","modified":"2023-11-15T21:35:02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:55:02.891904Z"}],"nvd":[{"id":"CVE-2021-31844","description":"A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.","status":"published","published":"2021-09-17T14:15:08.237Z","modified":"2026-06-17T03:52:20.19Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:58.933037Z"}]}}