CVE-2018-6855

CVE-2018-6855 is a local privilege escalation vulnerability affecting Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2. An authenticated local attacker can exploit a specific IOCTL to write a constant value to a user-controlled address, allowing them to modify process token privileges. This enables the attacker to gain SE_DEBUG_NAME privilege, interact with higher-privileged processes, and execute arbitrary code in their security context. The vulnerability has a CVSSv3 score of 7.8 (High), indicating a low attack complexity and requiring local user privileges for exploitation, leading to high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.