Read the docs
TI-2018-10610 Aliases CVE-2018-14780GHSA-xwgg-25ph-4c8p

An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver.

Priority LOW 22CWE-125Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.

Why it matters now

EPSS 0.00449 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:yubico:piv_manager:*:*:*:*:*:*:*:*before 1.4.2VulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2b:*:*:*:*:*:*:*1.4.2bVulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2c:*:*:*:*:*:*:*1.4.2cVulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2d:*:*:*:*:*:*:*1.4.2dVulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2e:*:*:*:*:*:*:*1.4.2eVulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2f:*:*:*:*:*:*:*1.4.2fVulnerableYubico
cpe:2.3:a:yubico:piv_manager:1.4.2g:*:*:*:*:*:*:*1.4.2gVulnerableYubico
cpe:2.3:a:yubico:piv_tool:*:*:*:*:*:*:*:*before 1.6.0VulnerableYubico
cpe:2.3:a:yubico:smart_card_minidriver:*:*:*:*:*:*:*:*up to 3.7.3.160VulnerableYubico
  • cpe:2.3:a:yubico:piv_manager:*:*:*:*:*:*:*:* Versions before 1.4.2 Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2b:*:*:*:*:*:*:* Versions 1.4.2b Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2c:*:*:*:*:*:*:* Versions 1.4.2c Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2d:*:*:*:*:*:*:* Versions 1.4.2d Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2e:*:*:*:*:*:*:* Versions 1.4.2e Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2f:*:*:*:*:*:*:* Versions 1.4.2f Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_manager:1.4.2g:*:*:*:*:*:*:* Versions 1.4.2g Vulnerable ·Yubico
  • cpe:2.3:a:yubico:piv_tool:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·Yubico
  • cpe:2.3:a:yubico:smart_card_minidriver:*:*:*:*:*:*:*:* Versions up to 3.7.3.160 Vulnerable ·Yubico

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14780
  2. 2026-10-03 Alias added: GHSA-xwgg-25ph-4c8p

References

Advisory 4

  • TI-2018-10609 A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. CVSS 3.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences