OpenSC EUVD-2026-33320

Physical access to the target system is required (CVSS AV:P). The vulnerability is triggered exclusively during pkcs15-init invocation - the PKCS#15 smart card initialization tool must be actively run by a user (UI:P) against a profile configuration file that the attacker has been able to craft or substitute. The malicious profile file must contain a key-value entry where the value begins with '=' and has a byte length exceeding sizeof(keybuf) in the OpenSC build. Exploitation is further constrained by high attack complexity (AC:H), meaning reliable memory corruption control is not straightforward. Limiting factors include: physical presence requirement, dependency on user action to invoke the tool, attacker's ability to modify or replace the profile file path used, and the non-default nature of running pkcs15-init (it is a provisioning tool, not a routine daemon). Systems that do not perform smart card initialization using pkcs15-init are not affected.

The aggregate risk signal is very low despite the memory-corruption class of vulnerability. CVSS 4.0 scores this at 1.0 with AV:P (physical access required), AC:H (high attack complexity), PR:N (no privileges needed by the attacker), UI:P (user interaction required), and limited impact metrics (VC:L/VI:L/VA:L). No EPSS data was provided in the source intelligence, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept code was identified. The physical access vector is the dominant risk-reduction factor: an attacker must be able to place a crafted profile file in a location where a user subsequently invokes pkcs15-init against it. The high attack complexity further reduces likelihood of reliable exploitation even when access conditions are met. The impact scope is limited to the local process - SC:N/SI:N/SA:N confirms no cross-component scope change. Real-world priority is low for most organizations; only environments where physical access to smart card provisioning workstations is not tightly controlled warrant elevated concern.

An attacker with physical access to a smart card provisioning workstation replaces or supplants a legitimate pkcs15-init profile configuration file with a crafted variant containing a key value entry that begins with '=' and includes a payload exceeding sizeof(keybuf) bytes. When an operator runs pkcs15-init and the malicious profile is parsed, do_key_value() performs an unchecked memcpy into keybuf, overflowing the stack buffer and corrupting adjacent memory, potentially leading to a crash or limited code execution within the pkcs15-init process context. No public proof-of-concept is known at time of analysis, and the high attack complexity rating reflects the difficulty of reliably controlling execution after the overflow.