CVE-2025-49010
Low · 3.8CVSS
3.8
EPSS
0.1%
Published
Mar 30, 2026
CISA due date
—
The record
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensc | 0 | 0.26.1-160000.3.1 |
| openSUSE:Tumbleweed | opensc | 0 | 0.27.1-1.1 |
Related vulnerabilities
- CVE-2025-66037 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-66038 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-66215 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2026-10275 A flaw has been found in OpenSC up to 0.26.1. Also affects opensc
- CVE-2026-40528 OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun… Also affects opensc
- CVE-2025-13763 Multiple uses of uninitialized variables were found in libopensc that may lead to… Also affects opensc
- CVE-2024-8443 A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. Also affects opensc
- CVE-2024-45619 A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. Also affects opensc