Read the docs
TI-2025-40564 Aliases CVE-2025-66038

OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers

Priority MEDIUM 63CWE-126Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial OpenSC (OpenSC): 0.27.0Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSCOpenSCbefore 0.27.00.27.0Patch availableCNA
  • OpenSC VendorOpenSC Affected before 0.27.0 Fixed in 0.27.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*before 0.27.0VulnerableOpenSC
  • cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:* Versions before 0.27.0 Vulnerable ·OpenSC

Remediation

  • Fix · CNA OpenSC (OpenSC) Fixed in 0.27.0

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66038

References

Exploit 1

Patch 1

Advisory 1

  • TI-2025-40563 OpenSC: Out of Bounds vulnerability CVSS 3.1MEDIUM 6.8
  • TI-2019-04558 sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. CVSS 3.0HIGH 7.5
  • TI-2021-13306 Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs. CVSS 3.1HIGH 7.5
  • TI-2019-12067 An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. CVSS 3.0HIGH 7.5
  • TI-2023-21453 Opensc: potential pin bypass when card tracks its own login state CVSS 3.1MEDIUM 6.6
  • TI-2023-21454 Opensc: multiple memory issues with pkcs15-init (enrollment tool) CVSS 3.1MEDIUM 6.4
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences