The vulnerability is a buffer overflow in the message parsing function of the Secure Access client. When a server that has been tampered with sends a specially crafted packet, the client can overwrite a small portion of memory, which may lead to memory corruption or a denial‑of‑service condition. The flaw does not provide remote code execution but can compromise the client’s stability and integrity.

The affected product is Absolute Software Secure Access. All versions prior to 14.50 are vulnerable; the exact affected versions are not listed beyond that threshold.

The CVSS score of 2.3 indicates low severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker who controls a modified server that clients connect to, meaning the attacker must first compromise or impersonate a legitimate server. The limited scope of the memory overwrite also reduces overall risk, though impacted systems could suffer crashes or integrity issues.