EUVD-2026-26422Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
CVE-2026-33450 is an out of bounds read vulnerability in the Secure Access MacOS client prior to 14.50. Attackers with control of a modified server can send a malformed packet to the client causing a denial of service.
AnalysisAI
Out-of-bounds read in Absolute Secure Access macOS client prior to version 14.50 allows remote attackers with control of a modified server to send malformed packets triggering denial of service. The vulnerability requires high attack complexity (modified server infrastructure and user interaction) and results in availability impact only, with a low CVSS score of 2.3 reflecting limited real-world severity despite network accessibility.
Technical ContextAI
The vulnerability is an out-of-bounds read condition in the Secure Access macOS client, a network security and device management solution by Absolute Software. Out-of-bounds reads occur when software attempts to access memory locations outside the bounds of allocated buffers, typically during packet parsing or protocol handling. The CVSS vector indicates network attack vector with high complexity (AC:H) and user interaction required (UI:P), suggesting the vulnerability resides in client-side packet parsing logic triggered by a specially crafted network packet. The condition is limited to macOS platforms and does not affect confidentiality or integrity-only availability (VA:L) is impacted, consistent with denial-of-service outcomes from memory read errors.
RemediationAI
Upgrade Secure Access macOS client to version 14.50 or later to resolve the out-of-bounds read vulnerability. The vendor has released a patch; administrators should deploy this update across all macOS endpoints running Secure Access. For environments unable to patch immediately, restrict network access to trusted servers only and educate users not to interact with unknown or suspicious network sources. Implement network segmentation to limit potential attack surface from compromised or rogue servers. Monitor for any denial-of-service incidents on patched and unpatched clients. Refer to https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33450 for patch availability and deployment guidance.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today