EUVD-2026-33680
GHSA-c758-vvqj-x96q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Patch name: 814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a patch to fix this issue.
AnalysisAI
Buffer overflow in OpenSC's pkcs11-tool component (versions up to and including 0.26.1) exposes users of the key generation functionality to memory corruption when processing maliciously oversized PKCS#11 URI object IDs. An unauthenticated remote attacker can trigger the flaw in the test_kpgen_certwrite function, but exploitation requires passive user interaction and high attack complexity, reflected in the extremely low CVSS 4.0 score of 1.3 with impact limited to the vulnerable component only. Publicly available exploit code exists (E:P confirmed in CVSS vector), but no public exploit identified at time of analysis in CISA KEV, and real-world mass exploitation is significantly constrained by the required user participation and attack complexity.
Technical ContextAI
OpenSC is an open-source smart card framework and toolkit. The affected component is pkcs11-tool, a command-line utility for managing PKCS#11 cryptographic tokens. The root cause is a CWE-120 Classic Buffer Overflow: the function test_kpgen_certwrite in src/tools/pkcs11-tool.c copies data from a PKCS#11 URI's object ID field into the fixed-size opt_object_id buffer without first validating that opt_object_id_len does not exceed sizeof(opt_object_id). The PR diff for fix commit 814f745b confirms two missing bounds checks - one in main() during URI parsing and one inside test_kpgen_certwrite() itself - both of which were absent prior to the patch. When an oversized object ID is supplied, adjacent memory is corrupted, potentially affecting program state. The CPE identifier lists vendor as 'n/a' (cpe:2.3:a:n/a:opensc:*:*:*:*:*:*:*:*), which is a non-standard NVD artifact; the authoritative project is the OpenSC open-source project hosted at github.com/OpenSC/OpenSC.
RemediationAI
Apply upstream fix commit 814f745b3b6d100295f65f1935edd33d520d33ab, available at https://github.com/OpenSC/OpenSC/commit/814f745b3b6d100295f65f1935edd33d520d33ab, which adds explicit bounds validation - checking opt_object_id_len against sizeof(opt_object_id) - at two code points in pkcs11-tool.c. The fix is delivered via PR #3684 (https://github.com/OpenSC/OpenSC/pull/3684); a formal tagged release version incorporating this commit (e.g., 0.26.2 or later) has not been independently confirmed from the available data, so users should build from the patched commit or monitor the OpenSC release page for a new version. As a compensating control pending patching, restrict pkcs11-tool key generation operations to internally generated, trusted PKCS#11 URIs and prohibit passing user-supplied or externally sourced URI strings directly to pkcs11-tool - this eliminates the primary attack delivery path without disabling the tool entirely. Given the CVSS 4.0 score of 1.3 and the absence of KEV-confirmed exploitation, immediate emergency patching is not warranted for most environments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today