CVE‑2026‑40949 is a buffer overflow vulnerability (CWE‑121) affecting the Absolute Software Secure Access Windows client before version 14.50. The flaw allows a local attacker with control of the client to overflow an internal buffer and cause the application to terminate, resulting in a denial of service for all users of that client instance.

The vulnerability impacts the Windows installation of Absolute Software Secure Access releases earlier than 14.50. No later versions have been reported to be affected, and no specific sub‑versions are listed by the vendor.

With a CVSS score of 6.8 the issue is considered moderate severity. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. The attack requires local presence on the Windows machine, meaning an attacker must have access to the client executable or the ability to run code on the host. Exploitation would result in a service crash, potentially disrupting secure remote access to protected resources. Because the impact is limited to local denial of service and there is no remote execution vector, the overall risk is moderate but still warrants prompt remediation.