EUVD-2026-33315
GHSA-7rrw-cv3r-3cgg
Severity by source
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.
AnalysisAI
Stack buffer overflow in OpenSC's PIV card handler allows a physically present attacker to corrupt memory by presenting a crafted PIV smart card or USB device that returns a URL field exceeding 118 bytes in the Key History Object ASN.1 response, triggering the overflow in piv_process_history() within src/libopensc/card-piv.c. All OpenSC versions prior to 0.27.0-rc1 are affected; the vulnerability is confirmed by the vendor fix in commit 3f24f0b and PR #3558. With a CVSS 4.0 score of 1.0 (AV:P/AC:H/UI:P), exploitation is severely constrained by mandatory physical access and high attack complexity, with no CISA KEV listing and no public exploit identified at time of analysis.
Technical ContextAI
OpenSC is a widely used open-source library and toolkit for interacting with PKCS#15 and PIV-compliant smart cards. The vulnerable function piv_process_history() in src/libopensc/card-piv.c processes the Key History Object returned by a PIV card via ASN.1 encoding. Prior to the fix, the function read the URL field from the card's ASN.1 response and copied it into a fixed-size stack buffer without validating the input length against the 118-byte boundary, constituting a classic CWE-121 (Stack-based Buffer Overflow). The patch adds an explicit bounds check rejecting URLs longer than 118 bytes with SC_ERROR_INVALID_ASN1_OBJECT, and additionally introduces SHA-256 hash validation (enforcing exactly 64 ASCII hex characters) for the filename component of the URL. The CPE string cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:* confirms the vulnerability affects all versions of the opensc software component regardless of platform.
RemediationAI
The upstream fix is available in commit 3f24f0b and PR #3558 against the OpenSC GitHub repository, targeting release 0.27.0-rc1; however, 0.27.0-rc1 is a release candidate - a final stable tagged release has not been independently confirmed at time of analysis, so organizations should monitor https://github.com/OpenSC/OpenSC/releases for the stable 0.27.0 release. As a compensating control, enforce strict physical access policies restricting which smart cards can be inserted into systems running OpenSC, permitting only organizationally issued and cryptographically verified PIV cards. Environments that process externally sourced, untrusted, or user-supplied smart cards carry the highest residual risk and should treat this with elevated urgency. If PIV card support is not operationally required, disabling the PIV card driver in OpenSC configuration eliminates this attack surface entirely but will prevent all PIV card functionality. Applying the patch by building from the fixed commit is the recommended definitive remediation.
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. Rated
Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15
Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC
Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in O
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenS
A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-r
A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs1
Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c
Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003
Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in
A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 coul
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today