The vulnerability is a buffer overflow in the message parsing function of the Secure Access client. When a server that has been tampered with sends a specially crafted packet, the client can overwrite a small portion of memory, which may lead to memory corruption or a denial‑of‑service condition. The official description does not state that this flaw enables remote code execution, so it is not confirmed to provide that capability; the impact is limited to client instability and integrity issues.

The affected product is Absolute Software Secure Access. All versions prior to 14.50 are vulnerable; the exact affected versions are not listed beyond that threshold.

The CVSS score of 2.3 indicates low severity. The EPSS score of < 1% demonstrates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker who controls a modified server that clients connect to, meaning the attacker must first compromise or impersonate a legitimate server. The limited scope of the memory overwrite also reduces overall risk, though impacted systems could suffer crashes or integrity issues.