Absolute Secure Access up to 14.49 Message buffer overflow

Summaryinfo

A vulnerability described as critical has been identified in Absolute Secure Access up to 14.49. This issue affects some unknown processing of the component Message Handler. Such manipulation leads to buffer overflow. This vulnerability is documented as CVE-2026-40950. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Absolute Secure Access up to 14.49. It has been rated as critical. Affected by this issue is an unknown code block of the component Message Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. CVE summarizes:

CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access server prior to 14.50. Attackers with control of a modified client can send a specially crafted message to the server and cause a denial of service

The advisory is available at absolute.com. This vulnerability is handled as CVE-2026-40950 since 04/16/2026. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 14.50 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1323). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Absolute Secure Access

Productinfo

Vendor

• Absolute

Name

• Secure Access

Version

• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 14.9
• 14.10
• 14.11
• 14.12
• 14.13
• 14.14
• 14.15
• 14.16
• 14.17
• 14.18
• 14.19
• 14.20
• 14.21
• 14.22
• 14.23
• 14.24
• 14.25
• 14.26
• 14.27
• 14.28
• 14.29
• 14.30
• 14.31
• 14.32
• 14.33
• 14.34
• 14.35
• 14.36
• 14.37
• 14.38
• 14.39
• 14.40
• 14.41
• 14.42
• 14.43
• 14.44
• 14.45
• 14.46
• 14.47
• 14.48
• 14.49

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion