CVE-2026-33449 describes a buffer overflow in the message handling function of the Secure Access client before version 14.50. An attacker who controls a modified server can send a cryptographically valid message that overwrites a small portion of client memory, which could lead to a denial of service. The vulnerability is a classic memory corruption flaw that may crash the client when an attacker delivers specially crafted packets, though it does not provide a path to arbitrary code execution. Given its low severity score of 2.3, the impact is limited to the stability of the affected client but remains disruptive for users dependent on the service.

The affected product is Absolute Software Secure Access. Clients running any version prior to 14.50 are vulnerable; the issue does not appear in 14.50 and later releases.

The CVSS score of 2.3 reflects a low severity risk, and the EPSS score of < 1 % indicates a very low probability of exploitation. The attack vector is inferred to be remote, originating from an attacker‑controlled server that interacts with the client. Because the flaw requires the attacker to supply a valid cryptographic message, deployment may involve a compromised or rogue server, but the lack of public exploitation evidence suggests the risk is primarily theoretical. Nonetheless, any environment where clients connect to untrusted or externally controlled servers should consider the potential for denial of service.