Fortra BoKS CVE-2026-14316

Exploitation requires the application to enter the revoked-key error path - i.e., the attacker (or the authentication flow) must cause BoKS to construct a failure reason for a revoked key - and the final formatted message must be long enough to exceed the undersized heap buffer, so the specific content/length of the revoked-key failure string is the concrete prerequisite. Per the CVSS vector, user interaction is required (UI:R), which limits fully automated remote exploitation; no privileges are stated as required (PR:N). Realistic risk is further bounded by exposure of the affected BoKS component to the attacker and by whether a revoked-key condition can be induced on demand.

The vendor CVSS of 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) frames this heap-based buffer overflow (CWE-122) as a network-reachable, unauthenticated flaw requiring user interaction, with high confidentiality and integrity impact but no availability impact. The A:N rating is notably inconsistent with the vulnerability class: a sprintf() write past the end of a heap allocation is classic memory corruption that would typically threaten process stability and therefore availability (A:H) - this discrepancy should be verified against the Fortra advisory. No EPSS score, CISA KEV listing, or POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AC:L rating also warrants scrutiny: reaching the overflow requires driving the code into the specific revoked-key error path and producing a formatted failure message long enough to exceed the undersized buffer, which is a conditional trigger rather than a trivially reproducible one (arguably AC:H). Net assessment: this is a genuine memory-corruption bug in a security-critical privileged-access product and should be patched promptly, but absent EPSS/KEV/POC signals it reads as a vendor-disclosed issue without demonstrated in-the-wild weaponization - prioritize based on BoKS exposure rather than treating it as an imminent mass-exploitation threat.

An attacker interacts with a BoKS component over the network in a way that forces the revoked-key error path to execute (e.g., presenting or triggering handling of a revoked authentication key). The resulting human-readable failure reason is built via sprintf() into an undersized heap buffer, overflowing it; a carefully shaped message could corrupt adjacent heap metadata or data, potentially leading to code execution or sensitive-data compromise. No public exploit code is identified at time of analysis, and the CVSS vector indicates user interaction is required to reach the vulnerable path.