The vulnerability is a stack-based buffer overflow and out-of-bounds write in the Sentinel Keys Server application for Windows. The server fails to validate the length of the first field in an input message, allowing a maliciously crafted message to overwrite memory and execute code. This flaw can be used to gain local privilege escalation to NT AUTHORITY\SYSTEM.

Affected products are Thales Sentinel Keys Server running on Windows, with versions earlier than 1.3.8.0.

The CVSS score of 7.3 indicates high severity. The lack of an EPSS score means no publicly known exploitation rate is reported. Because the flaw requires a local attacker to send an input message to the server, the attack vector is local. Remote exploitation is not described by the vendor, and the vulnerability is not listed in the CISA KEV catalog. Given these factors, the risk is significant for environments where the application is exposed to untrusted users, but the opportunity for remote exploitation remains limited.