Secure Access macOS CVE-2026-33450

The attacker must control a modified or malicious server capable of sending crafted network packets to the Secure Access client. The client user must interact with or process the malicious packet (UI:P from CVSS), meaning passive network exposure is insufficient. Exploitation is limited to Secure Access macOS client versions prior to 14.50. Non-default configuration is not required, but successful exploitation depends on the client receiving network traffic from an attacker-controlled source rather than legitimate Absolute servers, indicating this is a targeted attack scenario rather than a widespread worm risk.

This vulnerability presents LOW real-world risk despite network accessibility. CVSS 2.3 with multiple limiting factors: AC:H (high complexity) requires attacker infrastructure (modified server), UI:P (user interaction) requires client user action, and impact is availability-only (VA:L). The CVSS v4.0 vector shows no exploitation evidence metric assigned (E:X), and no CVSS v3.1 score is provided for comparison. No KEV (CISA Known Exploited Vulnerabilities) status is indicated, and no public exploit code is referenced. The attack chain requires adversary control of network infrastructure and client-side interaction-a scenario limited to targeted attacks against specific users or organizations. For most deployments, risk is managed by applying the available patch; unpatched systems are only at risk if users interact with traffic from compromised or malicious servers on the same network.

An attacker gains control of a network infrastructure component (e.g., compromises a Wi-Fi access point or DNS server) and sends a specially crafted malformed packet to a Secure Access macOS client. When a user with the vulnerable client version interacts with or accepts the malicious packet, the out-of-bounds read is triggered during packet parsing, causing the client to crash or hang, resulting in denial of service to that user's device until the client is restarted.