{"id":"CVE-2026-78402","kind":"vulnerability","aliases":["CVE-2026-78402"],"related":[],"title":"Thales Sentinel Keys Server: buffer overflow lets local users gain SYSTEM rights","description":"Stack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers. \n\n\n\nSentinel Keys Server does not check the length of the first field in\nthe input message. A local attacker may craft an input and send it to Sentinel\nKeys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling\nlocal privilege escalation.\n\n\n\n\n\nThis issue affects Sentinel Keys Server: versions\nlower than 1.3.8.0.","summary":"Thales Sentinel Keys Server on Windows does not check the length of the first field in incoming messages, causing a stack-based buffer overflow and out-of-bounds write. A local attacker who sends a crafted message can run code as NT AUTHORITY\\SYSTEM.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["sentinel-keys-server","thales","vendor","windows"],"not_affected_if":["version-1.3.8.0-or-later"],"how_to_check":"- Check the installed Sentinel Keys Server version on the Windows host, comparing it against `1.3.8.0`.","fix":"- Sentinel Keys Server: move to `1.3.8.0` or later.","status":"open","published_at":"2026-10-30T20:17:17+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","triaged_at":"2026-10-30T20:26:27+00:00","updated_at":"2026-10-30T20:26:27+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-30T20:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- Sentinel Keys Server: move to `1.3.8.0` or later.","reach":"local","title":"Thales Sentinel Keys Server: buffer overflow lets local users gain SYSTEM rights","impact":"high","summary":"Thales Sentinel Keys Server on Windows does not check the length of the first field in incoming messages, causing a stack-based buffer overflow and out-of-bounds write. A local attacker who sends a crafted message can run code as NT AUTHORITY\\SYSTEM.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","thales","sentinel-keys-server"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as SYSTEM on the Windows machine, enabling privilege escalation","analyst_note":"Confirm the affected version range and whether a vendor advisory from Thales lists the fixed build and any workaround; the NVD entry alone does not confirm this.","how_to_check":"- Check the installed Sentinel Keys Server version on the Windows host, comparing it against `1.3.8.0`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.3.8.0-or-later"],"who_is_affected":"Only Windows hosts running Sentinel Keys Server below version `1.3.8.0` are affected. The attacker must have local access to the machine, so exposure is mainly a concern on shared or multi-user systems. unknown whether the sources describe other configurations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4211,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-78402':15A,18A '1.3.8.0':147C 'affect':140C 'allow':91C 'attack':59B,112C 'author':70B,132C 'base':48B,74C 'bound':55B,81C 'buffer':5A,49B,75C,93C 'caus':44B 'check':34B,99C 'code':67B,128C 'craft':63B,114C 'cve':13A,16A 'enabl':134C 'escal':137C 'execut':129C 'field':40B,105C 'first':39B,104C 'gain':10A 'incom':42B 'input':108C,116C 'issu':139C 'key':3A,21B,28B,87C,95C,122C,142C 'lead':126C 'length':36B,101C 'let':7A 'local':8A,58B,111C,135C 'lower':145C 'may':113C,125C 'messag':43B,64B,109C 'nt':69B,131C 'out-of-bound':52B,78C 'overflow':6A,50B,76C,92C 'privileg':136C 'right':12A 'run':66B 'send':61B,118C 'sentinel':2A,20B,27B,86C,94C,121C,141C 'sentinel-keys-serv':19B 'server':4A,22B,29B,88C,96C,123C,143C 'stack':47B,73C 'stack-bas':46B,72C 'system':11A,71B,133C 'thale':1A,23B,26B,85C 'user':9A 'vendor':24B 'version':144C 'vulner':83C 'window':25B,31B,90C 'write':56B,82C","nicknames":[],"mitigations":[],"who_affected":"Only Windows hosts running Sentinel Keys Server below version `1.3.8.0` are affected. The attacker must have local access to the machine, so exposure is mainly a concern on shared or multi-user systems. unknown whether the sources describe other configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@thalesgroup.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78402","severity":null,"published_at":"2026-10-30T20:17:17+00:00","modified_at":"2026-10-30T20:17:17+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","fetched_at":"2026-10-30T20:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}