CVE-2026-94395

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94395", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "state": "PUBLISHED", "assignerShortName": "THA-PSIRT", "dateReserved": "2026-09-21T13:29:20.497Z", "datePublished": "2026-11-05T18:12:54.173Z", "dateUpdated": "2026-11-05T19:08:41.066Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T18:12:54.173Z"}, "title": "Stack-based buffer overflow in SafeNet Authentication Client SIS token engine", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client SIS token engine", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "10.8 R7", "lessThanOrEqual": "10.9 R3 (build 10.9.7449)", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_sis_token_engine:*:*:windows:*:*:*:*:*", "versionStartIncluding": "10.8_r7", "versionEndIncluding": "10.9_r3_build_10.9.7449_"}]}]}], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered\u00a0by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may\ncause a denial of service or potentially arbitrary code execution with the privileges of the affected process.\u00a0Affected releases\u00a0start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered&nbsp;by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may<br>cause a denial of service or potentially arbitrary code execution with the privileges of the affected process.&nbsp;<div>Affected releases&nbsp;start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).</div>"}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=7786064a2b905350cdc1f87df291bf92&sysparm_article=KB0031250", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later."}]}], "credits": [{"lang": "en", "value": "Jonas Lejon, Triop AB", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:08:37.663004Z", "id": "CVE-2026-94395", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:08:41.066Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-94395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T19:08:37.663004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:06:11.781Z"}}], "cna": {"title": "Stack-based buffer overflow in SafeNet Authentication Client SIS token engine", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jonas Lejon, Triop AB"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Thalesgroup", "product": "Safenet Authentication Client SIS token engine", "versions": [{"status": "affected", "version": "10.8 R7", "versionType": "custom", "lessThanOrEqual": "10.9 R3 (build 10.9.7449)"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.", "base64": false}]}], "references": [{"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=7786064a2b905350cdc1f87df291bf92&sysparm_article=KB0031250", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered\u00a0by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may\ncause a denial of service or potentially arbitrary code execution with the privileges of the affected process.\u00a0Affected releases\u00a0start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).", "supportingMedia": [{"type": "text/html", "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered&nbsp;by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may<br>cause a denial of service or potentially arbitrary code execution with the privileges of the affected process.&nbsp;<div>Affected releases&nbsp;start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based buffer overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client_sis_token_engine:*:*:windows:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "10.9_r3_build_10.9.7449_", "versionStartIncluding": "10.8_r7"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-11-05T18:12:54.173Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94395", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:08:41.066Z", "dateReserved": "2026-09-21T13:29:20.497Z", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "datePublished": "2026-11-05T18:12:54.173Z", "assignerShortName": "THA-PSIRT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Safenet Authentication Client SIS token engine", "vendor": "Thalesgroup", "versions": [{"lessThanOrEqual": "10.9 R3 (build 10.9.7449)", "status": "affected", "version": "10.8 R7", "versionType": "custom"}]}], "source": "psirt@thalesgroup.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered\u00a0by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may\ncause a denial of service or potentially arbitrary code execution with the privileges of the affected process.\u00a0Affected releases\u00a0start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449)."}], "id": "CVE-2026-94395", "lastModified": "2026-11-06T21:33:01.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@thalesgroup.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94395", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:08:37.663004Z", "version": "2.0.3"}}]}, "published": "2026-11-05T19:17:28.617", "references": [{"source": "psirt@thalesgroup.com", "url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=7786064a2b905350cdc1f87df291bf92&sysparm_article=KB0031250"}], "sourceIdentifier": "psirt@thalesgroup.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-787"}, {"lang": "en", "value": "CWE-1284"}], "source": "psirt@thalesgroup.com", "type": "Secondary"}]}

{"bugzilla": {"description": "SafeNet Authentication Client: SafeNet Authentication Client: arbitrary code execution via malicious smart card", "id": "2567879", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567879"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in SafeNet Authentication Client (SAC). A stack-based buffer overflow vulnerability in the SIS token engine allows an attacker connecting a malicious physical or software-emulated smart card to execute arbitrary code with the privileges of the affected process. This flaw occurs during card processing prior to user authentication or personal identification number (PIN) entry. Successful exploitation could lead to arbitrary code execution or cause the application to crash, resulting in a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-94395", "public_date": "2026-11-05T18:12:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94395\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94395\nhttps://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=7786064a2b905350cdc1f87df291bf92&sysparm_article=KB0031250"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires physical access to connect a crafted hardware card or local privileges to attach an emulated token device. SafeNet Authentication Client is proprietary third-party middleware that is not packaged or distributed within Red Hat Enterprise Linux or other Red Hat product lines. As a result, standard Red Hat installations are unaffected unless administrators have independently deployed this vendor software.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.8 R7,10.9 R3 (build 10.9.7449)]"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 83.0, "source": "matching"}]}, "original": {"product": "Safenet Authentication Client SIS token engine", "source": "cna", "vendor": "Thalesgroup"}, "product": "safenet_authentication_client", "vendor": "thalesgroup"}], "created": "2026-11-05T21:00:21.109708+00:00", "updated": "2026-11-06T16:30:07.051764+00:00", "vendors": ["thalesgroup", "thalesgroup$PRODUCT$safenet_authentication_client"]}