CVE-2025-66037
Low · 3.9CVSS
3.9
EPSS
0.3%
Published
Mar 30, 2026
CISA due date
—
The record
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensc | 0 | 0.26.1-160000.3.1 |
| openSUSE:Tumbleweed | opensc | 0 | 0.27.1-1.1 |
Related vulnerabilities
- CVE-2025-66038 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-66215 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-49010 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2026-10275 A flaw has been found in OpenSC up to 0.26.1. Also affects opensc
- CVE-2026-40528 OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun… Also affects opensc
- CVE-2025-13763 Multiple uses of uninitialized variables were found in libopensc that may lead to… Also affects opensc
- CVE-2024-8443 A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. Also affects opensc
- CVE-2024-45619 A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. Also affects opensc