CVE-2026-10275
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Buffer overflow vulnerability in OpenSC up to 0.26.1. The test_kpgen_certwrite function in pkcs11-tool.c can be exploited remotely, though exploitation is difficult.
Risk Assessment
An attacker can crash the pkcs11-tool tool or potentially execute arbitrary code, compromising smart card security.
Recommendation
Apply the patch named 814f745b3b6d100295f65f1935edd33d520d33ab.
Other vulnerabilities in OpenSC
See all- CVE-2026-40528Low
OpenSC before version 0.27.0 (fixed in commit 0358817) contains a stack and heap buffer overrun in the do_key_value() function in src/pkcs15init/profile.c. Attackers can supply a crafted profile configuration file, causing buffer overrun and memory corruption.
- CVE-2026-40510Low
OpenSC before 0.27.0-rc1 has a stack buffer overflow in piv_process_history() in src/libopensc/card-piv.c. A physically present attacker can present a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response, causing memory corruption.
- CVE-2024-8443Low
A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to APDUs during card enrollment using pkcs15-init may lead to out-of-bounds access, potentially allowing arbitrary code execution.
- CVE-2024-45620Low
A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs, leading to incorrect access to initialized parts of the buffer when buffers are partially filled with data.
- CVE-2024-45619Medium
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
- CVE-2024-45618Low
A vulnerability was found in pkcs15-init in OpenSC due to insufficient or missing checking of return values of functions. An attacker could use a crafted USB device or smart card presenting specially crafted APDU responses, leading to the use of uninitialized variables.
- CVE-2024-45617Low
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient checking of function return values. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses, leading to work with uninitialized variables.
- CVE-2024-45616Low
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient control of the response APDU buffer and its length during card communication. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses.
- CVE-2024-45615Low
In OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK, there is a missing initialization of variables that are expected to be initialized before being used as arguments to other functions. This can lead to unpredictable behavior or potential security issues.
Original NVD description (English source)
A flaw has been found in OpenSC up to 0.26.1. This affects the function test_kpgen_certwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Patch name: 814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a patch to fix this issue.