CVE-2018-6852

CVE-2018-6852 is a Local Privilege Escalation vulnerability affecting Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2. An authenticated local attacker can exploit an IOCTL 0x80202298 flaw to manipulate memory, specifically zeroing out security descriptors of privileged processes. This allows the attacker to execute code with SYSTEM privileges, leading to a complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSSv3 score of 7.8 (High) due to its low attack complexity and lack of user interaction. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.