The vulnerability is a stack-based buffer overflow combined with missing authorization in Thales Sentinel Keys Server on Windows. An attacker can send an HTTP request with an oversized first field; the server does not validate the length and does not check authentication, allowing the attacker to inject code that runs with SYSTEM privileges, effectively compromising the server.

Affected product: Thalesgroup Sentinel Keys Server running on Windows. All versions lower than 1.3.8.0 are impacted.

The CVSS score of 9.3 indicates critical severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is remote via HTTP; an unauthenticated attacker who crafts a malicious request can trigger the buffer overflow and achieve remote code execution as NT AUTHORITY \ SYSTEM. Knowledge of the service endpoint is needed but typical web exposure makes the exploitation easy to attempt.