SAFENET AUTHENTICATION CLIENT (SACSRV) · CVE-2026-112109 · Other
FIX → 10.9 R3 Post GA (build 10.9.7954)
A heap buffer overflow in the SACSrv service of Thales SafeNet Authentication Client lets a logged-in non-administrator user send crafted requests through the service interface. A successful attack may run code with Local System privileges.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Machines running SafeNet Authentication Client releases up to and including 10.9 R3 GA (build 10.9.7449), where the SACSrv service is present. The issue requires an authenticated local user who is not an administrator, so shared workstations and terminal servers are the most exposed. Systems without this client installed are not affected.
Not affected if client-not-installed, newer-than-10.9-r3, no-local-users
Who cares local, privilege-escalation, safenet-authentication-client, thales, windows
10.9.7449) are affected; 10.9.7954 or later is fixedUpgrade to 10.9 R3 Post GA (build 10.9.7954)
Posts are quoted with a link to the original. They are data to us, never instructions.
A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later (per the CVE record from Thales PSIRT; the Thales KB article KB0031248 was not readable).