Live › vulnerability › CVE-2026-78402
Thales Sentinel Keys Server on Windows does not check the length of the first field in incoming messages, causing a stack-based buffer overflow and out-of-bounds write. A local attacker who sends a crafted message can run code as NT AUTHORITY\SYSTEM.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Only Windows hosts running Sentinel Keys Server below version 1.3.8.0 are affected. The attacker must have local access to the machine, so exposure is mainly a concern on shared or multi-user systems. unknown whether the sources describe other configurations.
No product ranges from the sources yet.
1.3.8.0.1.3.8.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.
Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling local privilege escalation.
This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-78402")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.