EUVD-2026-33320
GHSA-vxjj-52h8-95w5
Severity by source
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.
AnalysisAI
Stack and heap buffer overruns in OpenSC's pkcs15-init tooling corrupt memory when processing a maliciously crafted PKCS#15 profile configuration file. Affected versions prior to 0.27.0 contain no length validation in the do_key_value() function before a memcpy into the fixed-size keybuf buffer, allowing overflow when a key value entry begins with '=' and exceeds sizeof(keybuf) bytes. Exploitation is severely constrained by a CVSS 4.0 score of 1.0 - physical access, high attack complexity, and user interaction are all required - and no public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
OpenSC is an open-source smart card middleware library used for PKCS#11 and PKCS#15 cryptographic operations. The pkcs15-init utility processes profile configuration files to initialize smart card token structures. The vulnerable code path in src/pkcs15init/profile.c within the do_key_value() function reads key-value pairs from these profile files. Prior to the fix in commit 0358817, a key value entry beginning with '=' was passed directly to memcpy into the stack-allocated keybuf without first comparing key_len against sizeof(keybuf). CWE-121 (Stack-based Buffer Overflow) is the root cause class: the unbounded copy overflows keybuf on the stack and can also corrupt adjacent heap allocations depending on allocator layout. The fix introduces an explicit guard - if (key_len > sizeof(keybuf)) { parse_error(...); return 1; } - rejecting oversized values before the copy executes. CPE cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:* indicates all OpenSC versions prior to the patch are affected.
RemediationAI
Upgrade OpenSC to version 0.27.0 or later, which incorporates the fix from commit 0358817. The upstream patch is available at https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59. If upgrading immediately is not feasible, restrict write access to profile configuration files used by pkcs15-init so that only trusted administrators can supply or modify them - this eliminates the primary attack vector since exploitation requires delivering a crafted profile file to the target. Additionally, enforce physical access controls on workstations where pkcs15-init is invoked for smart card provisioning, as AV:P requires local physical presence. Auditing existing profile configuration files for anomalous key-value entries longer than expected is a low-cost compensating check while a patch is staged.
sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. Rated
Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15
Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC
Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in O
A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenS
A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-r
A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0
A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs1
Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c
Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003
Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in
A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 coul
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today