CVE-2026-94395
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 05, 2026
Vendor
unknown
Description
A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449).