Description

A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-11-05T18:17:00.787Z",
  "pubdate": "2026-11-05T18:17:00.787Z",
  "executiveSummary": "This vulnerability involves a heap-based buffer overflow in the SACSrv service of Thales SafeNet Authentication Client (SAC), identified in versions up to and including 10.9 R3 GA (build 10.9.7449). The flaw resides within the service interface, allowing a locally authenticated, non-privileged user to execute arbitrary code with NT AUTHORITY\\SYSTEM privileges.\nThe vulnerability represents a significant security risk, as it permits lateral movement or complete host compromise via local privilege escalation. Successful exploitation requires an attacker to have established a local session on the target system. By sending maliciously crafted input to the SACSrv interface, an attacker can trigger memory corruption within the heap, leading to control flow hijacking. Given the elevated execution context, this vulnerability effectively bypasses traditional access controls and sandbox protections. Organizations relying on SafeNet Authentication Client are at risk of full system compromise if local access is achieved by unauthorized or malicious users.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow located within the SACSrv service component of Thales SafeNet Authentication Client. SACSrv operates as a Windows service running under the Local System account, facilitating communication for authentication-related tasks. The flaw exists in the handling of requests directed to the service interface, where improper bounds checking during the processing of input data allows an attacker to write beyond the allocated heap memory boundaries.\nThe attack flow initiates when an authenticated, non-privileged local user interacts with the SACSrv interface. The attacker provides a specifically crafted data payload designed to exceed the size of the destination heap buffer allocated by the service. When the SACSrv process receives and attempts to process this request, the lack of adequate validation regarding the payload length leads to a buffer overflow. This memory corruption overwrites adjacent heap metadata or function pointers stored within the heap space.\nBy precisely controlling the contents of the overflow, the attacker can hijack the process's execution flow. Once the instruction pointer or a critical function pointer is redirected to malicious code—often facilitated via techniques such as heap spraying or ROP (Return-Oriented Programming) chains—the payload executes with the integrity level of the service process. Because SACSrv runs with Local System privileges, the malicious code inherits these permissions, effectively providing the attacker with full control over the operating system environment.\nThis issue affects all SAC releases up to and including 10.9 R3 GA (build 10.9.7449). The vulnerability is strictly local, requiring the attacker to have established a login session on the target machine; however, it requires no interaction from an administrator. The post-exploitation impact is severe, as it facilitates complete bypass of Windows security boundaries, enabling persistent malware installation, credential dumping, or further administrative actions on the host."
}