CVE-2026-78403

Summary

A stack-based buffer overflow in Thales Sentinel Keys Server on Windows occurs when processing HTTP requests due to missing input length validation, allowing unauthenticated remote attackers to overwrite the stack and achieve code execution as SYSTEM; combined with a missing authorization check (CWE-862), this enables full system compromise.

Exploitability

Trivial to exploit over the network without authentication or user interaction, requiring only sending a specially crafted HTTP request with an overly long first field.

Blast radius

Successful exploitation grants NT AUTHORITY\SYSTEM privileges, enabling complete host takeover, lateral movement, and data exfiltration across the infrastructure using the vulnerable server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Sentinel Keys Server to version 1.3.8.0 or later, as explicitly stated in the description as the fixed release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.