{"id":"CVE-2026-94395","kind":"vulnerability","aliases":["CVE-2026-94395"],"related":[],"title":"Thales SafeNet Authentication Client: smart card input overflows memory, risking code execution","description":"A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may\ncause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).","summary":"A stack-based buffer overflow in the SIS token engine of Thales SafeNet Authentication Client lets a malicious or emulated smart card crash the process or potentially run code with its privileges. The flaw can be reached before authentication or PIN entry.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","safenet-authentication-client","smart-card","thales","windows"],"not_affected_if":["sac-not-installed"],"how_to_check":"- Check the installed SafeNet Authentication Client version against the affected range: releases starting at `10.8 R7`, including `10.9 R3 GA (build 10.9.7449)`.","fix":"- Move to a release newer than `10.9 R3 GA (build 10.9.7449)`; the sources do not name the exact fixed build.","status":"open","published_at":"2026-11-05T19:17:28+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:43:09+00:00","updated_at":"2026-11-05T19:43:09+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T19:43:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than `10.9 R3 GA (build 10.9.7449)`; the sources do not name the exact fixed build.","reach":"local","title":"Thales SafeNet Authentication Client: smart card input overflows memory, risking code execution","impact":"high","summary":"A stack-based buffer overflow in the SIS token engine of Thales SafeNet Authentication Client lets a malicious or emulated smart card crash the process or potentially run code with its privileges. The flaw can be reached before authentication or PIN entry.","audience":"businesses","category":"other","nicknames":[],"who_cares":["thales","safenet-authentication-client","smart-card","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs with the privileges of the affected process, or the process crashes.","analyst_note":"Confirm the fixed SAC version and whether a physical card or only the local smart card stack can trigger it; check the Thales advisory.","how_to_check":"- Check the installed SafeNet Authentication Client version against the affected range: releases starting at `10.8 R7`, including `10.9 R3 GA (build 10.9.7449)`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["sac-not-installed"],"who_is_affected":"Organizations running Thales SafeNet Authentication Client from release 10.8 R7 onward, including 10.9 R3 GA, where the SIS token engine handles smart cards. The sources do not say whether default configurations are exposed or which deployments are most at risk. Teams not using SAC can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000734,"input_tokens":4282,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-94395':15A,18A '10.8':134C '10.9':139C '10.9.7449':143C 'affect':127C,129C 'arbitrari':119C 'authent':3A,22B,43B,68B,81C,106C 'base':32B,75C 'buffer':33B,76C 'build':142C 'card':6A,26B,51B,100C 'caus':112C 'client':4A,23B,44B,82C 'code':11A,58B,120C 'crash':52B 'cve':13A,16A 'denial':114C 'emul':49B,98C 'engin':39B,86C 'entri':71B,109C 'execut':12A,121C 'flaw':63B 'ga':141C 'includ':137C 'input':7A 'issu':102C 'let':45B 'malici':47B,93C 'may':111C 'memori':9A 'occur':104C 'overflow':8A,34B,77C 'physic':94C 'pin':70B,108C 'potenti':56B,118C 'privileg':61B,124C 'process':54B,87C,128C 'r3':140C 'r7':135C 'reach':66B 'releas':130C 'risk':10A 'run':57B 'sac':83C,133C,138C 'safenet':2A,21B,42B,80C 'safenet-authentication-cli':20B 'servic':116C 'sis':37B,84C 'smart':5A,25B,50B,99C 'smart-card':24B 'softwar':97C 'software-emul':96C 'stack':31B,74C 'stack-bas':30B,73C 'start':131C 'thale':1A,27B,41B,79C 'token':38B,85C 'trigger':90C 'window':28B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Thales SafeNet Authentication Client from release 10.8 R7 onward, including 10.9 R3 GA, where the SIS token engine handles smart cards. The sources do not say whether default configurations are exposed or which deployments are most at risk. Teams not using SAC can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","other","safenetauthenticationclient","smartcard","thales","windows"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@thalesgroup.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94395","severity":null,"published_at":"2026-11-05T19:17:28+00:00","modified_at":"2026-11-05T19:17:28+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}