CVE-2026-112109
Description
A flaw was found in SafeNet Authentication Client (SAC). An authenticated local user can trigger a heap-based buffer overflow through the SACSrv service interface. Successful exploitation may allow arbitrary code execution with elevated Local System privileges, resulting in local privilege escalation.
Statement
Red Hat Product Security rates this vulnerability as Important because an authenticated local user can achieve complete administrative control via memory corruption in the service daemon, justifying this rating despite requiring preexisting local access. SafeNet Authentication Client is third-party proprietary software that is not packaged, distributed, or maintained within Red Hat products. Consequently, Red Hat enterprise products are not directly impacted by this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict local access to the SACSrv service interface or stop the SACSrv service on Windows endpoints where smart card authentication is not required: upgrade to SafeNet Authentication Client build 10.9.7954 (10.9 R3 Post GA), which corrects integer overflow and bounds validation during message handling within the SACSrv service interface to prevent heap corruption, closing crafted service interface messages. Until patched, this is only a concern on Windows systems running Thales SafeNet Authentication Client with the SACSrv service — Red Hat enterprise products and non-Windows environments are unaffected — so Restrict local interactive logon access to hosts running SACSrv and stop the SACSrv service on systems where client authentication is not actively required. As a compensating measure, Enable Address Space Layout Randomization to randomize SACSrv memory layout and hinder reliable redirection of execution flow, Enable Control Flow Integrity to validate indirect call targets and function pointers before corrupted flow executes, Enforce Arbitrary Code Guard to block allocation or modification of executable memory pages within the SACSrv process, Deploy Windows Defender Application Control in enforced mode to block unauthorized secondary binaries spawned by SACSrv, Configure EDR agents to detect behavioral exploitation patterns and anomalous child processes originating from SACSrv, and Enforce Non-Executable memory (NX/XD) on heap pages to block execution of injected shellcode. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow and heap-based buffer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
