Is Symantec DLP vulnerable to CVE-2026-10536

Products

• Data Loss Prevention
• Data Loss Prevention Core Package

Issue/Introduction

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.

Resolution

The Symantec Data Loss Prevention Suite (DLP Agents and DLP Servers) is not vulnerable to CVE-2026-10536.

This critical use-after-free requires establishing HTTP/2 stream-dependency relationships between libcurl handles and then performing a handle reset followed by cleanup, which dereferences the freed dependency structure. This product communicates exclusively over HTTP/1.x HTTPS and does not configure HTTP/2, stream dependencies, or handle reset operations of any kind in its network transport layer. The three-step trigger sequence cannot be constructed, resulting in a verdict of NOT_EXPLOITABLE.