CVE-2026-103531

Buffer overflow vulnerability in OpenSC up to 0.26.1. The test_kpgen_certwrite function in pkcs11-tool.c can be exploited remotely, though exploitation is difficult.

OpenSC before version 0.27.0 (fixed in commit 0358817) contains a stack and heap buffer overrun in the do_key_value() function in src/pkcs15init/profile.c. Attackers can supply a crafted profile configuration file, causing buffer overrun and memory corruption.

OpenSC before 0.27.0-rc1 has a stack buffer overflow in piv_process_history() in src/libopensc/card-piv.c. A physically present attacker can present a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response, causing memory corruption.

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to APDUs during card enrollment using pkcs15-init may lead to out-of-bounds access, potentially allowing arbitrary code execution.

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs, leading to incorrect access to initialized parts of the buffer when buffers are partially filled with data.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.

A vulnerability was found in pkcs15-init in OpenSC due to insufficient or missing checking of return values of functions. An attacker could use a crafted USB device or smart card presenting specially crafted APDU responses, leading to the use of uninitialized variables.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient checking of function return values. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses, leading to work with uninitialized variables.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient control of the response APDU buffer and its length during card communication. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses.

In OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK, there is a missing initialization of variables that are expected to be initialized before being used as arguments to other functions. This can lead to unpredictable behavior or potential security issues.