Opensc EUVD-2025-209129

The CVSS vector (AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) yields a base score of 3.8, reflecting several mitigating factors: Physical attack vector (AV:P) requires an attacker to be locally present with the computer; High complexity (AC:H) implies significant barriers to exploitation; User interaction (UI:R) is required-the token must be actively used during the attack. Impact is limited to confidentiality, integrity, and availability at Low severity. The local scope and physical requirement significantly constrain real-world attack probability compared to network-based vulnerabilities with identical CVSS scores. No EPSS data or CISA KEV status was provided, but the combination of physical barrier and high complexity suggests this is a low-priority remediation relative to higher-severity or more-accessible vulnerabilities. The vulnerability primarily affects environments where physical security controls are weak or untrusted devices can be connected to computers where OpenSC is actively in use.

An attacker with physical access to a computer prepares a malicious USB smart card or hardware token configured to present specially crafted APDU responses that exceed buffer limits in the card-oberthur module. When a legitimate user or administrator inserts the token and initiates a card operation using OpenSC (e.g., signing, authentication, or certificate retrieval), the oversized response triggers a stack buffer overflow, potentially corrupting adjacent memory. Depending on memory layout and kernel protections, this may crash the OpenSC process (denial of service) or, in conditions favorable to the attacker, enable arbitrary code execution with user privileges. No public proof-of-concept code has been identified, and the high complexity (AC:H) suggests exploitation requires detailed knowledge of OpenSC internals and the target system's memory layout.