CVE-2026-94395High· 7.0▾ TwilightA stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).
safenet_authentication_client_sis_token_engine >= 10.8 R7 <= 10.9 R3 (build 10.9.7449)Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78402High· 7.8Stack Buffer Overflow in Sentinel Keys Server
CVE-2026-78403Critical· 9.8Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
CVE-2023-41251High· 7.2A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11
CVE-2023-4273Medium· 6.0A flaw was found in the exFAT driver of the Linux kernel
CVE-2022-2304High· 7.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVE-2020-14498Critical· 9.6HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.