CVE-2025-66037lowCWE-125

CVE-2025-66037: fallo de gravedad baja en OpenSC

OpenSC: Out of Bounds vulnerability

Publicada el

Seguir esta CVE+ Monitorear OpenSC+ Monitorear opensc

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.9epss 0.3%
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
OpenSC · OpenSC
CVEs relacionadas — OpenSC

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-40510LOWOpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.cEPSS 0.3%CVE-2025-66038LOWOpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointersEPSS 0.3%CVE-2025-13763MEDIUMLibopensc: opensc: multiple uses of uninitialized variableEPSS 0.3%CVE-2026-40528LOWOpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.cEPSS 0.2%CVE-2025-66215LOWOpenSC: Stack-buffer-overflow WRITE in card-oberthurEPSS 0.2%CVE-2025-49010LOWOpenSC: Stack-buffer-overflow WRITE in GET RESPONSEEPSS 0.1%