OpenSC pkcs11-tool EUVD-2026-33680

Exploitation specifically requires a user to invoke pkcs11-tool's key generation functionality and supply a PKCS#11 URI with an object ID whose length exceeds sizeof(opt_object_id) - this is the precise trigger confirmed by the patch diff adding the check 'if (opt_object_id_len > sizeof(opt_object_id))'. Passive user interaction (UI:P) is mandatory: the victim must actively run pkcs11-tool with attacker-influenced input; fully autonomous remote exploitation without any user participation is not supported by the CVSS vector. High attack complexity (AC:H) further constrains the attack, indicating that even with user interaction, reliable exploitation is non-trivial. Impact is strictly scoped to the pkcs11-tool process itself (no system or kernel compromise). Limiting factors: victim must be using pkcs11-tool interactively with a crafted URI; the object ID must exceed the fixed buffer threshold; no privilege escalation or scope change is achievable. Deployments where pkcs11-tool is used only with internally generated, trusted URIs are not exposed to this attack path.

The CVSS 4.0 score of 1.3 accurately reflects genuinely low real-world risk for this vulnerability. The attack vector is network (AV:N), indicating remote reachability, but high attack complexity (AC:H) and required passive user interaction (UI:P) sharply constrain autonomous exploitation - a fully hands-off remote attack is not supported by the CVSS vector. Impact is bounded to low-severity confidentiality, integrity, and availability effects on the vulnerable component (VC:L/VI:L/VA:L) with zero impact on subsequent system components (SC:N/SI:N/SA:N), ruling out privilege escalation or system-wide compromise. This vulnerability is not listed in CISA KEV, so no confirmed active exploitation exists. A public exploit has been published (referenced in the data), which elevates urgency slightly above a purely theoretical finding, but the combination of high complexity and user interaction requirements makes opportunistic mass exploitation implausible. EPSS score was not provided in the input data and cannot be stated. The tension between network attack vector and mandatory user interaction suggests the realistic attack path is social engineering a user to run pkcs11-tool with a crafted URI, not a direct network-injectable exploit. Overall, this is a low-priority patch-at-next-maintenance-window issue for most organizations.

An attacker crafts a PKCS#11 URI with an object ID field that exceeds the length of the opt_object_id buffer in pkcs11-tool, then socially engineers a target user into running a pkcs11-tool key generation command (--keypairgen or equivalent) with that malicious URI as input. When the oversized object ID is processed by test_kpgen_certwrite without the now-patched length check, adjacent memory is overwritten, yielding low-severity corruption of confidentiality, integrity, or availability within the pkcs11-tool process. A public exploit has been published (referenced via an external link in the CVE data), though the high attack complexity and mandatory user interaction limit its practical utility for automated or mass exploitation.