{"id":"CVE-2026-78402","title":"Stack Buffer Overflow in Sentinel Keys Server","summary":"Stack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers. \n\n\n\nSentinel Keys Server does not check the length of the first field in\nthe input message. A local atta…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-121","CWE-787"],"vendor":"Thalesgroup","product":"Sentinel Keys Server","affected":["sentinel_keys_server < 1.3.8.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T20:00:33.506955Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T20:00:42.731Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-78402","references":[{"url":"https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216"}],"tags":["cve.org"],"epss":0.00147,"epssPercentile":0.03968,"ingestedAt":"2026-11-05T16:24:31.435Z","slug":"CVE-2026-78402","body":"## Overview\n\nStack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers. \n\n\n\nSentinel Keys Server does not check the length of the first field in\nthe input message. A local attacker may craft an input and send it to Sentinel\nKeys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling\nlocal privilege escalation.\n\n\n\n\n\nThis issue affects Sentinel Keys Server: versions\nlower than 1.3.8.0.\n\n## Affected\n\n- `sentinel_keys_server < 1.3.8.0`\n\n## Remediation\n\nUpgrade latest version.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}