Opensc CVE-2025-66037

While the CVSS score of 3.9 appears low, the real-world risk is limited by the physical attack vector requiring direct smart card interface access (AV:P). The CVSS vector shows high attack complexity (AC:H) and no privilege escalation needed (PR:N). The tripartite impact (confidentiality, integrity, availability each scored as Low) reflects the out-of-bounds read's potential to leak heap memory, corrupt adjacent heap structures, or trigger application crashes. EPSS data is not provided, but exploitation requires both crafted PKCS#15 input AND physical device access, making opportunistic remote exploitation impossible. This is a real but constrained vulnerability affecting security-sensitive systems (smart card middleware) in localized threat models where physical access or insider threats are concerns. The availability of fuzzing input in the description suggests reproducibility, though no standalone POC package has been independently confirmed.

An attacker with physical access to a smart card reader (e.g., a compromised kiosk, shared workstation, or insider with hardware access) inserts a crafted smart card or PKCS#15 container containing malicious X.509/SPKI fields. When the host system's OpenSC middleware processes the card, the sc_pkcs15_pubkey_from_spki_fields() function triggers the out-of-bounds read, leaking adjacent heap memory that may contain cryptographic keys, session tokens, or other sensitive data. Alternatively, the read may corrupt heap metadata, causing the OpenSC daemon or calling application to crash, resulting in denial of service. High attack complexity and physical access requirements limit this to insider threats or scenarios where attackers can control smart card content or supply chain.