CVE-2025-66038
Low · 3.9CVSS
3.9
EPSS
0.3%
Published
Mar 30, 2026
CISA due date
—
The record
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensc | 0 | 0.26.1-160000.3.1 |
| openSUSE:Tumbleweed | opensc | 0 | 0.27.1-1.1 |
Related vulnerabilities
- CVE-2025-66037 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-66215 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-49010 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2026-10275 A flaw has been found in OpenSC up to 0.26.1. Also affects opensc
- CVE-2026-40528 OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun… Also affects opensc
- CVE-2025-13763 Multiple uses of uninitialized variables were found in libopensc that may lead to… Also affects opensc
- CVE-2024-8443 A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. Also affects opensc
- CVE-2024-45619 A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. Also affects opensc