CVE-2025-66215

Published: Mar 30, 2026Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

Affected (1)

Products: Opensc Project: Opensc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opensc Project Opensc	Before 0.27.0

Related CWEs

Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References (4)

https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d

Source: security-advisories@github.com

Patch

https://github.com/OpenSC/OpenSC/pull/3436

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2

Source: security-advisories@github.com

PatchVendor Advisory

https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.