EUVD-2026-26421Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
CVE-2026-33449 is a buffer overflow in a message handling function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a cryptographically valid message to the client, overwriting a small portion of memory conceivably leading to a denial of service.
AnalysisAI
Buffer overflow in Absolute Secure Access prior to version 14.50 allows remote attackers to cause denial of service by sending a cryptographically valid message to the client, potentially overwriting memory. The vulnerability requires network access and user interaction (UI:P), making it a moderate-complexity attack with low availability impact. Vendor has released a patch available as of the CVE disclosure.
Technical ContextAI
Absolute Secure Access is a client-side endpoint protection and remote access platform. The vulnerability exists in the message handling function responsible for processing cryptographically valid messages from servers. The buffer overflow occurs when the client processes specially crafted messages without proper bounds checking on memory writes. This is a classic CWE-120 (buffer copy without checking size of input) scenario, though CWE is not formally assigned in available data. The cryptographic validation layer is bypassed or ineffective at preventing malformed message structures that trigger the overflow. The attack surface is the network interface where the client receives server messages, requiring the attacker to control or intercept/modify the server communication channel.
RemediationAI
Upgrade Absolute Secure Access to version 14.50 or later, which contains the patch released by the vendor. The vendor advisory is available at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33449. For organizations unable to immediately patch, implement network-level controls to restrict or monitor connections from untrusted server endpoints, as the vulnerability requires server-side message injection. Additionally, monitor for client crashes or unexpected terminations, which may indicate exploitation attempts. Note that user education on connecting only to trusted, official servers can reduce exposure, though it is not a substitute for patching.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today