{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94395", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "state": "PUBLISHED", "assignerShortName": "THA-PSIRT", "dateReserved": "2026-09-21T13:29:20.497Z", "datePublished": "2026-11-05T18:12:54.173Z", "dateUpdated": "2026-11-05T18:12:54.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T18:12:54.173Z"}, "title": "Stack-based buffer overflow in SafeNet Authentication Client SIS token engine", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client SIS token engine", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "10.8 R7", "lessThanOrEqual": "10.9 R3 (build 10.9.7449)", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_sis_token_engine:*:*:windows:*:*:*:*:*", "versionStartIncluding": "10.8_r7", "versionEndIncluding": "10.9_r3_build_10.9.7449_"}]}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered\u00a0by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may\ncause a denial of service or potentially arbitrary code execution with the privileges of the affected process.\u00a0Affected releases\u00a0start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered&nbsp;by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may<br>cause a denial of service or potentially arbitrary code execution with the privileges of the affected process.&nbsp;<div>Affected releases&nbsp;start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).</div>"}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=7786064a2b905350cdc1f87df291bf92&sysparm_article=KB0031250", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later."}]}], "credits": [{"lang": "en", "value": "Jonas Lejon, Triop AB", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{}

{}

{}