CVE-2026-94395 · Other
NO FIX YET · SEE WHAT TO DO
A stack-based buffer overflow in the SIS token engine of Thales SafeNet Authentication Client lets a malicious or emulated smart card crash the process or potentially run code with its privileges. The flaw can be reached before authentication or PIN entry.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Thales SafeNet Authentication Client from release 10.8 R7 onward, including 10.9 R3 GA, where the SIS token engine handles smart cards. The sources do not say whether default configurations are exposed or which deployments are most at risk. Teams not using SAC can skip it.
Not affected if sac-not-installed
Who cares safenet-authentication-client, smart-card, thales, windows
10.8 R7, including 10.9 R3 GA (build 10.9.7449).10.9 R3 GA (build 10.9.7449); the sources do not name the exact fixed build.A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).
This page as .md · .json · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.