CVE-2026-10275
Medium · 5.0CVSS
5.0
EPSS
0.3%
Published
Jun 1, 2026
CISA due date
—
The record
A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Patch name: 814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a patch to fix this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | opensc | 0 | 0.27.1-2.1 |
Related vulnerabilities
- CVE-2026-40528 OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun… Also affects opensc
- CVE-2025-13763 Multiple uses of uninitialized variables were found in libopensc that may lead to… Also affects opensc
- CVE-2025-66037 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-66038 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-66215 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2025-49010 OpenSC is an open source smart card tools and middleware. Also affects opensc
- CVE-2024-8443 A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. Also affects opensc
- CVE-2024-45619 A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. Also affects opensc