Sentinel Keys Server EUVD-2026-114363

Requires local access to a Windows host running Thales Sentinel Keys Server at a version below 1.3.8.0, with sufficient privilege to send an input message to the Sentinel Keys Server service (CVSS PR:L). The concrete trigger is a crafted input message whose first field exceeds a length the server does not validate, overflowing a stack buffer. No user interaction is needed (UI:N). Limiting factors: the attack is local only (AV:L), not remotely reachable; it presumes the attacker already holds low-privilege local access; and the CVSS 4.0 vector sets AT:P, indicating an additional attack requirement exists, though the sources do not describe what that condition is. Patching to 1.3.8.0 or later removes the affected code per the vendor advisory.

This is a local privilege escalation flaw (CVSS:4.0 AV:L/PR:L, base 7.3, HIGH) in Thales Sentinel Keys Server on Windows where a successful overflow yields code execution as NT AUTHORITY\SYSTEM, so technical impact is high (VC:H/VI:H/VA:H). The vulnerability is NOT network-reachable: an attacker must already have local, low-privilege access to the host (AV:L/PR:L), which substantially narrows the threat population versus a remote-unauthenticated bug of the same severity. The vendor's SSVC-style priority is 'this_week' rather than 'act_now'/'emergency', consistent with a serious-but-not-crisis LEP. No CISA KEV listing is present in the input, so exploitation status is 'no public exploit identified at time of analysis'; no POC or exploit reference is supplied. No EPSS score is provided, so widespread opportunistic exploitation probability cannot be quantified from the data. The CVSS 4.0 vector carries AT:P (an attack requirement exists), but the sources do not describe what that condition is, so the real-world triggerability beyond 'send a crafted input message' is unverified. Net: a genuine local-privilege-escalation-to-SYSTEM issue worth patching on the vendor's stated weekly cadence, but gated by the need for prior local access and not evidenced as actively exploited or trivially remote.

A low-privileged local user on a Windows host running Sentinel Keys Server (version below 1.3.8.0) crafts an input message whose first field exceeds the length the server fails to validate and sends it to the service. The oversized field overruns a stack buffer, and by controlling the overwritten data the attacker executes arbitrary code in the context of the Sentinel Keys Server service, which runs as NT AUTHORITY\SYSTEM, escalating from limited user to full system control. No public exploit code is identified in the available sources.