OpenSC CVE-2026-103531

Requires the SetCOS card driver code path in OpenSC to be exercised - specifically a file-creation operation that calls setcos_construct_fci_44 - with attacker-influenced file attribute data (type_attr, and per the full patch sec_attr/prop_attr) whose length exceeds the fixed stack buffer. In practice this means the attacker must supply or manipulate a SetCOS smart card or the sc_file_t attribute values processed locally by an OpenSC-based application; per the CVSS vector it needs PR:L and user interaction (UI:P), e.g. a user running the OpenSC tooling against the malicious card. The 'remote' characterization is not substantiated by the code path and limits realistic exploitation to scenarios involving physical/local card interaction. Only OpenSC builds using the SetCOS driver are affected.

This is a stack-based buffer overflow (CWE-121) in OpenSC's SetCOS card driver, specifically setcos_construct_fci_44() in src/libopensc/card-setcos.c, where attacker-influenced file attribute lengths (type_attr_len, and per the fuller patch sec_attr_len/prop_attr_len) are copied into a fixed-size stack buffer with no bounds check. The signals point to LOW real-world risk despite the 'remotely' claim. The vendor (VulDB) CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L scores 5.1 (medium), but VulDB routinely labels local/library-level flaws as 'remote,' and this is highly questionable: setcos_construct_fci_44 runs during file creation on a SetCOS smart card, so exploitation realistically requires a malicious or manipulated card (or local control over the sc_file_t attributes) rather than a network path - the AV:N is almost certainly inflated versus a true AV:L/AV:P exploitation surface (verify with vendor). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided; exploitation status is therefore no public exploit identified at time of analysis. The confirmed signal is that a vendor patch exists (OpenSC PR #3812, commit ad730304). The combination of PR:L, user interaction, a niche code path (SetCOS-specific driver), and only partial C/I/A impact makes this a low-priority, low-probability issue rather than an urgent one.

An attacker supplies a malicious SetCOS smart card (or otherwise controls the file-attribute input) so that type_attr_len exceeds the fixed stack buffer in setcos_construct_fci_44; when the OpenSC-based application constructs the file control information during a card file-creation operation, the oversized attribute is copied onto the stack, overflowing it. This could crash the process or potentially corrupt stack memory in the context of the user running the OpenSC tooling. No public exploit code was identified, and the authentication/local-use prerequisites make opportunistic exploitation unlikely.