Thales Sentinel Keys Server CVE-2026-78403 (CVSS 9.8) allows stack-based buffer overflow
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Thales
- Product
- Sentinel Keys Server
- First seen
Summary
TheHackerWire reports CVE-2026-78403, a critical (CVSS 9.8) stack-based buffer overflow and missing authorization flaw in Thales Sentinel Keys Server on Windows. The server does not check the length of a field in the HTTP request, which could let an attacker craft a malicious request.
If you use Thales
Apply the vendor patch for Sentinel Keys Server as soon as it is available
Restrict network access to the Sentinel Keys Server
Monitor the server for unusual HTTP requests
Limit local user access on servers running Sentinel Keys Server
Check whether Sentinel Keys Server runs on Windows in your environment
Apply the vendor fix from Thales when available
What the sources say 4
· Mastodon: “Sentinel Keys Server does not check the length of the first field in the input message.” Source
· Mastodon: “Sentinel Keys Server does not check the length of the first field in the HTTP request.” Source
· Mastodon: “Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.” Source
· Mastodon: “Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers.” Source