CVE-2025-66215

LOW

OpenSC: Stack-buffer-overflow WRITE in card-oberthur

Title source: cna

Description

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

References (4)

[X_Refsource_Confirm] https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2

[X_Refsource_Misc] https://github.com/OpenSC/OpenSC/pull/3436

[X_Refsource_Misc] https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d

View Writeup ZIP pw:eip

[X_Refsource_Misc] https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215

Scores

CVSS v3 3.8

EPSS 0.0002

EPSS Percentile 4.9%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-121

Status published

Products (2)

OpenSC/OpenSC < 0.27.0

opensc_project/opensc < 0.27.0

Published Mar 30, 2026

Tracked Since Mar 30, 2026