Memory corruption in the Secure Access Windows client allows an attacker who already has local control of the client to send malformed data to a vulnerable API, causing the application to crash. The result is a loss of availability for that client instance, interrupting users’ ability to connect to remote resources and potentially impacting business operations that rely on the client.

Absolute Software Secure Access Windows clients prior to version 14.50 are affected. The vulnerability is tied to any installation of the product that predates the 14.50 release, regardless of the host operating system version.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score of 0.00017 (< 1%) indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires local access—an attacker must already have privileges on the Windows machine to exploit the flaw. Because the flaw does not involve a network-facing interface, the likelihood of remote exploitation is low, but any local compromise can lead to immediate denial of service for that client.