CVE-2026-112109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112109", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "state": "PUBLISHED", "assignerShortName": "THA-PSIRT", "dateReserved": "2026-10-18T20:48:22.182Z", "datePublished": "2026-11-05T17:20:32.829Z", "dateUpdated": "2026-11-05T20:12:51.185Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T17:20:32.829Z"}, "title": "Local privilege escalation in SafeNet Authentication Client SACSrv", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client Service", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "10.9.7449", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_service:*:*:windows:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "10.9.7449"}]}]}], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,\u00a0non-administrator local user to trigger a heap-based buffer overflow through the service interface.\u00a0Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3\u00a0GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,&nbsp;non-administrator local user to trigger a heap-based buffer overflow through the service interface.&nbsp;Successful exploitation may allow arbitrary code execution with Local System privileges.<div>This issue affects SAC releases up to and including 10.9 R3&nbsp;GA (build 10.9.7449).</div>"}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=89d3c2ce2b105350cdc1f87df291bf55&sysparm_article=KB0031248", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.</p>"}]}], "credits": [{"lang": "en", "value": "David Carliez (david.carliez.consulting@gmail.com)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:12:41.015658Z", "id": "CVE-2026-112109", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:12:51.185Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-112109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T20:12:41.015658Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:12:34.056Z"}}], "cna": {"title": "Local privilege escalation in SafeNet Authentication Client SACSrv", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Carliez (david.carliez.consulting@gmail.com)"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client Service", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "10.9.7449"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.</p>", "base64": false}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=89d3c2ce2b105350cdc1f87df291bf55&sysparm_article=KB0031248", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,\u00a0non-administrator local user to trigger a heap-based buffer overflow through the service interface.\u00a0Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3\u00a0GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,&nbsp;non-administrator local user to trigger a heap-based buffer overflow through the service interface.&nbsp;Successful exploitation may allow arbitrary code execution with Local System privileges.<div>This issue affects SAC releases up to and including 10.9 R3&nbsp;GA (build 10.9.7449).</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer overflow or wraparound"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_service:*:*:windows:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "10.9.7449", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T17:20:32.829Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112109", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:12:51.185Z", "dateReserved": "2026-10-18T20:48:22.182Z", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "datePublished": "2026-11-05T17:20:32.829Z", "assignerShortName": "THA-PSIRT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Safenet Authentication Client Service", "vendor": "Thalesgroup", "versions": [{"lessThanOrEqual": "10.9.7449", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@thalesgroup.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated,\u00a0non-administrator local user to trigger a heap-based buffer overflow through the service interface.\u00a0Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3\u00a0GA (build 10.9.7449)."}], "id": "CVE-2026-112109", "lastModified": "2026-11-06T21:33:01.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@thalesgroup.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112109", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:12:41.015658Z", "version": "2.0.3"}}]}, "published": "2026-11-05T18:17:00.787", "references": [{"source": "psirt@thalesgroup.com", "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=89d3c2ce2b105350cdc1f87df291bf55&sysparm_article=KB0031248"}], "sourceIdentifier": "psirt@thalesgroup.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}], "source": "psirt@thalesgroup.com", "type": "Secondary"}]}

{"bugzilla": {"description": "SafeNet Authentication Client: SafeNet Authentication Client: Local privilege escalation via heap-based buffer overflow", "id": "2567812", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567812"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in SafeNet Authentication Client (SAC). An authenticated local user can trigger a heap-based buffer overflow through the SACSrv service interface. Successful exploitation may allow arbitrary code execution with elevated Local System privileges, resulting in local privilege escalation."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-112109", "public_date": "2026-11-05T17:20:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112109\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112109\nhttps://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=89d3c2ce2b105350cdc1f87df291bf55&sysparm_article=KB0031248"], "statement": "Red Hat Product Security rates this vulnerability as Important because an authenticated local user can achieve complete administrative control via memory corruption in the service daemon, justifying this rating despite requiring preexisting local access. SafeNet Authentication Client is third-party proprietary software that is not packaged, distributed, or maintained within Red Hat products. Consequently, Red Hat enterprise products are not directly impacted by this flaw.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,10.9.7449]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 92.0, "source": "matching"}]}, "original": {"product": "Safenet Authentication Client Service", "source": "cna", "vendor": "Thalesgroup"}, "product": "safenet_authentication_service", "vendor": "thalesgroup"}], "created": "2026-11-05T19:30:11.075298+00:00", "updated": "2026-11-06T16:30:07.053716+00:00", "vendors": ["thalesgroup", "thalesgroup$PRODUCT$safenet_authentication_service"]}