A stack‑based buffer overflow occurs in Thales SafeNet Authentication Client SIS token engine processing, which can be triggered by a malicious physical smart card or a software‑emulated card. The flaw manifests before authentication or PIN entry and may lead to denial of service or, more gravely, arbitrary code execution with the privileges of the running process. The vulnerability is a classic unchecked copy operation into a fixed‑size buffer, categorized as CWE‑121, CWE‑1284, and CWE‑787.

Thalesgroup’s SafeNet Authentication Client SIS token engine, starting with release 10.8 R7 and extending through 10.9 R3 GA (build 10.9.7449). All Windows installations of these versions are susceptible to the stack corruption.

The CVSS score of 7.0 indicates moderate to high impact, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to supply a malicious smart card or emulate one through software to interact with the token engine prior to user authentication. Once triggered, the exploit can hijack the process and execute arbitrary code, potentially compromising the entire host system if the process runs with elevated permissions.