EUVD-2026-44784Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and high privileges required per description and CVSS 4.0 input; availability-only impact with unchanged scope.
Primary rating from Vendor (Absolute).
CVSS VectorVendor: Absolute
Lifecycle Timeline
2DescriptionCVE.org
CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control.
AnalysisAI
Heap overflow in Absolute Security Secure Access client certificate parsing causes a local denial of service. Versions prior to 14.55 are affected. An attacker who already holds local administrator privileges on a managed endpoint can trigger the overflow to crash the Secure Access client, effectively disabling it on that machine. No public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The flaw resides in the certificate parsing function of Absolute Security's Secure Access client, identified by CPE cpe:2.3:a:absolute_security:secure_access:*:*:*:*:*:*:*:*. A heap overflow (CWE not formally assigned by NVD) occurs when the client processes a malformed or crafted certificate, corrupting heap memory in a way that results in application crash. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) confirms the vulnerability is entirely local-access and high-privilege-gated, with impact confined to the availability of the vulnerable system's client process. No confidentiality or integrity compromise is possible, and there is no scope change to subsequent systems.
RemediationAI
Upgrade Absolute Security Secure Access to version 14.55 or later, which resolves the heap overflow in the certificate parsing function. The vendor advisory at https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40953 should be consulted for deployment guidance and release notes. Because exploitation requires local administrator access, organizations that enforce strict privilege separation and least-privilege policies on managed endpoints already substantially reduce the realistic attack surface. There are no documented workarounds in the available data beyond enforcing local admin access controls, which limits who can trigger the condition in the first place.
More in Secure Access
View allPersistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Local privilege escalation in Absolute Secure Access Windows client versions prior to 14.50 allows authenticated local a
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Null dereference in the load-balancing subsystem of Absolute Secure Access servers (prior to 14.57) allows unauthenticat
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Memory corruption in Absolute Secure Access Windows clients prior to version 14.50 allows local authenticated attackers
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today