CVE-2026-40528

A flaw has been found in OpenSC up to 0.27.1, impacting the setcos_construct_fci_44 function in src/libopensc/card-setcos.c. Manipulation of the type_attr argument can lead to a stack-based buffer overflow. The attack can be launched remotely, and the patch is identified as ad730304052937c32b4eb489a06835ac6123632c.

Buffer overflow vulnerability in OpenSC up to 0.26.1. The test_kpgen_certwrite function in pkcs11-tool.c can be exploited remotely, though exploitation is difficult.

OpenSC before 0.27.0-rc1 has a stack buffer overflow in piv_process_history() in src/libopensc/card-piv.c. A physically present attacker can present a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response, causing memory corruption.

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to APDUs during card enrollment using pkcs15-init may lead to out-of-bounds access, potentially allowing arbitrary code execution.

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs, leading to incorrect access to initialized parts of the buffer when buffers are partially filled with data.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.

A vulnerability was found in pkcs15-init in OpenSC due to insufficient or missing checking of return values of functions. An attacker could use a crafted USB device or smart card presenting specially crafted APDU responses, leading to the use of uninitialized variables.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient checking of function return values. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses, leading to work with uninitialized variables.

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK due to insufficient control of the response APDU buffer and its length during card communication. An attacker could use a crafted USB device or smart card to present specially crafted APDU responses.

In OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK, there is a missing initialization of variables that are expected to be initialized before being used as arguments to other functions. This can lead to unpredictable behavior or potential security issues.