CVE-2026-78403 PUBLISHED

Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Assigner: THA-PSIRT
Reserved: 24.08.2026 Published: 30.10.2026 Updated: 30.10.2026

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM.

This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Thalesgroup
Product	Sentinel Keys Server
Versions	Default: unaffected affected from 0 to 1.3.8.0 (excl.)

Solutions

Upgrade to latest version.

Credits

Matt Hetelson (matthew.hetelson@revolutional.com) finder

References

https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216

Problem Types

CWE-121 Stack-based buffer overflow CWE
CWE-862 Missing Authorization CWE

Impacts

CAPEC-100 Overflow Buffers