Local privilege escalation via unsafe deserialization

Local privilege escalation in Sophos Intercept X for Windows 2024.2.0 and earlier allows local users to write arbitrary files. The Device Encryption component deserializes untrusted data, but Sophos has not disclosed the affected interface or how deserialization controls the file write. Exploitation requires low-privilege local access and a licensed, enabled Central Device Encryption deployment, and the resulting write occurs with elevated privileges.