Description

A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-05T19:17:28.617Z",
  "pubdate": "2026-11-05T19:17:28.617Z",
  "executiveSummary": "This vulnerability involves a stack-based buffer overflow within the Thales SafeNet Authentication Client (SAC) SIS token engine, an essential component for processing smart card interactions.\nThe flaw allows an attacker using a malicious physical or software-emulated smart card to corrupt memory during the initial processing stages, specifically before any authentication or PIN verification occurs.\nThe primary impact of this vulnerability is a denial of service (DoS) or the potential for arbitrary code execution within the context of the SAC process, which typically runs with elevated privileges.\nThe risk is significant as the attack vector does not require user authentication, potentially exposing systems to local adversaries or those capable of injecting virtual smart card signals.\nAffected releases include versions from SAC 10.8 R7 up to and including SAC 10.9 R3 GA (build 10.9.7449).\nOrganizations using these versions of SAC are at risk of system instability and unauthorized code execution if an attacker succeeds in triggering the overflow through a crafted smart card interaction.",
  "technicalDetails": "The vulnerability resides in the SIS (Smart card Integration Service) token engine of the Thales SafeNet Authentication Client. This engine is responsible for parsing and managing communication protocols between the host system and the smart card hardware or software-emulated interface.\nThe root cause is a stack-based buffer overflow during the processing of smart card data. When the SIS engine receives data from a card, it fails to perform adequate bounds checking on the input buffer before copying the data into a fixed-size stack memory area.\nAn attacker can exploit this by crafting a malicious smart card that sends a malformed or oversized packet during the initial card discovery or identification phase. Because this processing happens prior to authentication or PIN submission, the exploit vector is available to any party that can present a smart card to the reader or simulate a card interface at the software layer.\nExploitation involves sending a specially crafted input that exceeds the allocated stack space, overwriting adjacent memory including return addresses or function pointers. By carefully controlling the payload, an attacker can hijack the instruction pointer to redirect execution flow to attacker-supplied shellcode or existing executable memory regions (such as Return-Oriented Programming chains).\nThe attack flow follows these steps: 1) The target system detects a smart card or receives a signal from a software-emulated card; 2) The SAC SIS token engine initializes communication and buffers incoming card identification data; 3) The malformed packet is processed, exceeding the allocated stack buffer; 4) Memory corruption occurs, allowing for either process termination (leading to a denial of service) or control flow redirection (leading to arbitrary code execution).\nSince the SIS engine operates with the privileges assigned to the SAC background process, successful exploitation grants the attacker those same privileges on the host operating system. This facilitates lateral movement, credential theft, or further system compromise. The vulnerability is triggered locally, either through physical insertion of a malicious card or by exploiting software-based card emulation environments on the host."
}