Vulnerability · Published Oct 30, 2026 · Assigned by THA-PSIRT

CVE-2026-78402Stack Buffer Overflow in Sentinel Keys Server

High 7.8

In plain English

A high-severity stack buffer overflow in Sentinel Keys Server from Thalesgroup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 96.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling local privilege escalation. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.

Affected products (as reported)

Vendor	Product	Versions
Thalesgroup	Sentinel Keys Server	0 – before 1.3.8.0

Weakness: CWE-121, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216 vendor-advisory