OpenSC EUVD-2026-33315

Exploitation requires the attacker to be physically present and able to insert a crafted PIV smart card or USB device emulating a smart card into the target machine - remote exploitation is not possible per AV:P. The target must be running a vulnerable OpenSC version (before 0.27.0-rc1) with PIV card support enabled, which is the default for PIV-capable builds. The overflow is triggered specifically during processing of the Key History Object's URL field in the ASN.1 response; PIV cards that do not present a Key History Object, or whose URL field is 118 bytes or fewer, will not trigger the vulnerability. Additionally, the CVSS vector specifies UI:P (passive user interaction), meaning the card must be read and processed by the host system - simply having physical proximity is insufficient without triggering a card read operation. Key limiting factors include: mandatory physical access to the target machine, high attack complexity, the need for a specially crafted card or device, and the requirement that PIV card processing is actively invoked.

The CVSS 4.0 score of 1.0 is the primary quantitative signal and accurately reflects severe real-world constraints: physical access required (AV:P), high attack complexity (AC:H), passive user interaction required (UI:P), and only Low impact across confidentiality, integrity, and availability with no scope change to subsequent components (SC:N/SI:N/SA:N). The vulnerability is not listed in CISA KEV, and no public exploit or POC code has been identified at time of analysis; EPSS data was not provided in the input. Despite being a classic stack buffer overflow - a class historically associated with high exploitability - the physical access prerequisite and high complexity sharply limit the threat model to insider attacks or supply-chain scenarios involving tampered smart cards. The low CIA impact scoring suggests exploitation is more likely to result in localized process instability than reliable arbitrary code execution. This is a low-priority patching item for most organizations, but merits attention in high-security environments where untrusted or externally-sourced smart cards are inserted into sensitive workstations.

An adversary with physical access to a workstation - such as a malicious insider or a supply-chain attacker who has tampered with smart cards - inserts a crafted PIV card or a USB device emulating a smart card reader that returns a Key History Object whose URL field exceeds 118 bytes in the ASN.1 response. When OpenSC's piv_process_history() function processes the card, the oversized URL overflows the fixed stack buffer before the missing bounds check, triggering memory corruption. No public POC exists at time of analysis; given the high attack complexity (AC:H) and low impact scope, reliable exploitation for code execution may require additional effort beyond triggering the overflow.