{"id":"CVE-2026-112109","kind":"vulnerability","aliases":["CVE-2026-112109"],"related":[],"title":"Thales SafeNet Authentication Client: local user can gain SYSTEM privileges","description":"A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).","summary":"A heap buffer overflow in the SACSrv service of Thales SafeNet Authentication Client lets a logged-in non-administrator user send crafted requests through the service interface. A successful attack may run code with Local System privileges.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SafeNet Authentication Client (SACSrv)","fixed":["10.9 R3 Post GA (build 10.9.7954)"],"affected":"<= 10.9 R3 GA (build 10.9.7449)","ecosystem":"vendor"}],"ecosystems":[],"tags":["local","other","privilege-escalation","safenet-authentication-client","thales","windows"],"not_affected_if":["client-not-installed","newer-than-10.9-r3","no-local-users"],"how_to_check":"On Windows, open Installed Apps or Programs and Features and read the SafeNet Authentication Client version. Builds up to and including 10.9 R3 GA (10.9.7449) are affected; 10.9.7954 or later is fixed. Only the Windows SAC (SACSrv service) is listed. Also check any Linux or Mac SAC installs, but they are not listed as affected.","fix":"Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later (per the CVE record from Thales PSIRT; the Thales KB article KB0031248 was not readable).","status":"open","published_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","triaged_at":"2026-11-05T18:40:33+00:00","updated_at":"2026-11-05T18:42:40+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-05T18:40:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Thales SafeNet Authentication Client: local user can gain SYSTEM privileges","impact":"high","summary":"A heap buffer overflow in the SACSrv service of Thales SafeNet Authentication Client lets a logged-in non-administrator user send crafted requests through the service interface. A successful attack may run code with Local System privileges.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","safenet-authentication-client","thales"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains code execution as Local System","analyst_note":"Find the Thales advisory and the fixed release version for SAC SACSrv; the NVD entry gives only the affected range.","how_to_check":"- Check the installed SafeNet Authentication Client version in Installed Apps or Programs and Features on Windows.\n- Compare it with the affected range: releases up to and including `10.9 R3 GA (build 10.9.7449)`.","plain_action":"","needs_analyst":true,"not_affected_if":["client-not-installed","newer-than-10.9-r3"],"who_is_affected":"Machines running SafeNet Authentication Client releases up to and including 10.9 R3 GA (build 10.9.7449), where the SACSrv service is present. The issue requires an authenticated local user who is not an administrator, so shared workstations and terminal servers are the most exposed. Systems without this client installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4265,"output_tokens":554,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Thales advisory and the fixed release version for SAC SACSrv; the NVD entry gives only the affected range.","search":"'-112109':13A,16A '-2026':12A,15A '10.9':123C '10.9.7449':127C 'administr':52B,89C 'affect':116C 'allow':84C,107C 'arbitrari':108C 'attack':63B 'authent':3A,28B,43B,79C,86C 'authentication':18A 'base':97C 'buffer':34B,98C 'build':126C 'client':4A,19A,29B,44B,80C 'code':66B,109C 'craft':55B 'cve':11A,14A 'escal':25B,74C 'execut':110C 'exploit':105C 'ga':125C 'gain':8A 'heap':33B,96C 'heap-bas':95C 'includ':122C 'interfac':60B,103C 'issu':115C 'let':45B 'local':5A,21B,68B,72C,90C,112C 'log':48B 'logged-in':47B 'may':64B,106C 'non':51B,88C 'non-administr':50B,87C 'overflow':35B,99C 'privileg':10A,24B,70B,73C 'privilege-escal':23B 'privileges.this':114C 'r3':124C 'releas':118C 'request':56B 'run':65B 'sac':81C,117C 'sacsrv':20A,38B,82C 'safenet':2A,17A,27B,42B,78C 'safenet-authentication-cli':26B 'send':54B 'servic':39B,59B,102C 'success':62B,104C 'system':9A,69B,113C 'thale':1A,30B,41B,77C 'trigger':93C 'user':6A,53B,91C 'vulner':75C 'window':31B","nicknames":[],"mitigations":[],"who_affected":"Machines running SafeNet Authentication Client releases up to and including 10.9 R3 GA (build 10.9.7449), where the SACSrv service is present. The issue requires an authenticated local user who is not an administrator, so shared workstations and terminal servers are the most exposed. Systems without this client installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["authenticationclientsacsrv","safenetauthenticationclientsacsrv"],"ptokens":["authentication","client","sacsrv","safenet"],"labels":["high","local","other","privilegeescalation","safenetauthenticationclient","thales","windows"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@thalesgroup.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112109","severity":null,"published_at":"2026-11-05T18:17:00+00:00","modified_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","fetched_at":"2026-11-05T18:40:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112109:1819","url":"https://app.opencve.io/cve/CVE-2026-112109","severity":null,"published_at":"2026-11-05T18:42:40+00:00","modified_at":"2026-11-05T18:42:40+00:00","first_seen_at":"2026-11-05T18:42:40+00:00","fetched_at":"2026-11-05T18:42:40+00:00","note":"Fix found in the CVE record (assigner THA-PSIRT, via OpenCVE): upgrade to SAC 10.9 R3 Post GA build 10.9.7954 or later. The Thales KB article (KB0031248) is a JS portal I could not read, so nothing is marked verified. No exploitation or PoC found. Only SAC for Windows is listed as affected.","cites":["https://app.opencve.io/cve/CVE-2026-112109"]}],"documents":[{"id":78886,"url":"https://app.opencve.io/cve/CVE-2026-112109","title":"OpenCVE: CVE-2026-112109 (CNA record from Thales PSIRT, incl. vendor solution)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}