CVE-2025-14026
Vulnerable Python version used in Forcepoint One DLP Client
Description
Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.
INFO
Published Date :
Jan. 6, 2026, 3:15 p.m.
Last Modified :
Jan. 6, 2026, 5:15 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-14026
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update Forcepoint One DLP Client software.
- Apply vendor patches for the DLP client.
- Verify Python ctypes library restrictions are resolved.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-14026.
| URL | Resource |
|---|---|
| https://kb.cert.org/vuls/id/420440 | |
| https://support.forcepoint.com/s/article/000042256 | |
| https://www.kb.cert.org/vuls/id/420440 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-14026 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-14026
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-14026 vulnerability anywhere in the article.
-
CybersecurityNews
Forcepoint DLP Vulnerability Enables Memory Manipulation and Arbitrary Code Execution
A critical security flaw in Forcepoint One DLP Client has been disclosed, allowing attackers to bypass vendor-implemented Python restrictions and execute arbitrary code on enterprise endpoints. The vu ... Read more
-
Daily CyberSecurity
CVE-2025-14026: Forcepoint DLP Flaw Lets Attackers Unchain Restricted Python
A high-severity vulnerability in the Forcepoint One DLP Client has been disclosed, revealing a method for attackers to break out of a vendor-imposed “sandbox” and execute arbitrary code on protected e ... Read more
-
Daily CyberSecurity
Google Patches High-Severity “WebView” Flaw in Chrome 143
Google has announced an important security update for the Stable channel of its Chrome browser, rolling out patches to Windows, Mac, and Linux users to address a high-severity vulnerability that could ... Read more
The following table lists the changes that have been made to the
CVE-2025-14026 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jan. 06, 2026
Action Type Old Value New Value Added Reference https://www.kb.cert.org/vuls/id/420440 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jan. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Jan. 06, 2026
Action Type Old Value New Value Added Description Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed. Added Reference https://kb.cert.org/vuls/id/420440 Added Reference https://support.forcepoint.com/s/article/000042256