---
id: "CVE-2026-112109"
kind: "vulnerability"
aliases: ["CVE-2026-112109"]
title: "Thales SafeNet Authentication Client: local user can gain SYSTEM privileges"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SafeNet Authentication Client (SACSrv)", "fixed": ["10.9 R3 Post GA (build 10.9.7954)"], "affected": "<= 10.9 R3 GA (build 10.9.7449)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["local", "other", "privilege-escalation", "safenet-authentication-client", "thales", "windows"]
not_affected_if: ["client-not-installed", "newer-than-10.9-r3", "no-local-users"]
published_at: "2026-11-05T18:17:00+00:00"
first_seen_at: "2026-11-05T18:40:09+00:00"
updated_at: "2026-11-05T18:42:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112109", "first_seen_at": "2026-11-05T18:40:09+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-112109", "first_seen_at": "2026-11-05T18:42:40+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-112109"]}]
exploit_sources: []
---

# Thales SafeNet Authentication Client: local user can gain SYSTEM privileges

A heap buffer overflow in the SACSrv service of Thales SafeNet Authentication Client lets a logged-in non-administrator user send crafted requests through the service interface. A successful attack may run code with Local System privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SafeNet Authentication Client (SACSrv) affected <= 10.9 R3 GA (build 10.9.7449) fixed 10.9 R3 Post GA (build 10.9.7954)

## How to check

On Windows, open Installed Apps or Programs and Features and read the SafeNet Authentication Client version. Builds up to and including 10.9 R3 GA (10.9.7449) are affected; 10.9.7954 or later is fixed. Only the Windows SAC (SACSrv service) is listed. Also check any Linux or Mac SAC installs, but they are not listed as affected.

## Fix

Upgrade to SafeNet Authentication Client 10.9 R3 Post GA (build 10.9.7954) or later (per the CVE record from Thales PSIRT; the Thales KB article KB0031248 was not readable).

## Timeline

- 2026-11-05T18:40:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112109
- 2026-11-05T18:42:40+00:00 analyst https://app.opencve.io/cve/CVE-2026-112109 — Fix found in the CVE record (assigner THA-PSIRT, via OpenCVE): upgrade to SAC 10.9 R3 Post GA build 10.9.7954 or later. The Thales KB article (KB0031248) is a JS portal I could not read, so nothing is marked verified. No exploitation or PoC found. Only SAC for Windows is listed as affected.

## Documents

- [describes] OpenCVE: CVE-2026-112109 (CNA record from Thales PSIRT, incl. vendor solution) https://app.opencve.io/cve/CVE-2026-112109

## From the sources

A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_