Stack-Based Buffer Overflow in Thales SafeNet Authentication Client
CVE-2026-94395

7HIGH

Key Information:

Vendor

Thalesgroup

Status
Safenet Authentication Client Sis Token Engine
Vendor
CVE Published:
5 November 2026

What is CVE-2026-94395?

A stack-based buffer overflow vulnerability in the Thales SafeNet Authentication Client allows exploitation via a malicious physical or software-emulated smart card. This vulnerability can be triggered during the processing of the SIS token engine, before user authentication or PIN entry. If exploited, it may result in a denial of service or enable arbitrary code execution with the privileges of the affected process. The vulnerability affects versions starting from SAC 10.8 R7 up to SAC 10.9 R3 GA (build 10.9.7449).

Affected Version(s)

Safenet Authentication Client SIS token engine Windows 10.8 R7 <= 10.9 R3 (build 10.9.7449)

References

https://supportportal.thalesgroup.com/csm?id=kb_article_v...
vendor-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonas Lejon, Triop AB
.