Opensc CVE-2025-66038

The CVSS vector (AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates physical attack vector (smartcard proximity required) and high complexity, yielding a base score of 3.9. However, the actual risk is nuanced: while the low CVSS score reflects the physical barrier to exploitation, the vulnerability occurs when OpenSC processes untrusted data from smart cards or card-like sources, which is its primary operational context. The memory corruption potential (out-of-bounds reads/writes) could enable information disclosure or denial of service in environments where OpenSC interfaces with untrusted or compromised cards. The vulnerability is not actively exploited (no KEV status indicated), and no public exploit code exists at time of analysis, but the condition is easily triggered by malformed compact-TLV structures. The patch availability (version 0.27.0) and upstream fix via commit 6db171bcb6fd7cb3b51098fefbb3b28e44f0a79c reduce operational risk for patched deployments.

An attacker with physical access to a card reader introduces a maliciously crafted smart card containing compact-TLV data with a tag element {0x0A} that claims a 10-byte value in a 1-byte buffer. When an OpenSC-based application (such as a PKI client or access control system) reads the card and calls sc_compacttlv_find_tag to search for tag 0x00, the function returns a pointer to buf+1 with outlen=10, causing subsequent code that dereferences this pointer to read or write beyond the buffer boundary. This could leak sensitive information from adjacent memory or corrupt application state. No public exploit code exists at time of analysis, but the vulnerability is trivially reproducible with a simple malformed TLV structure.