CVE-2018-6856

CVE-2018-6856 is a local privilege escalation vulnerability affecting Sophos SafeGuard Enterprise, SafeGuard Easy, and SafeGuard LAN Crypt client software versions prior to their respective patches. An attacker can exploit a specific IOCTL (0x8020601C) to write to a user-controlled memory address, enabling them to manipulate security descriptors of privileged processes. This allows for arbitrary code execution with SYSTEM privileges. The vulnerability has a CVSSv3 score of 7.8 (High), indicating a low attack complexity and requiring local user privileges, but leading to high impact on confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, publicly available exploit code (Metasploit, ExploitDB), or significant community discussion or media coverage. The EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild.