{"id":"CVE-2025-13763","aliases":["BELL-CVE-2025-13763","DEBIAN-CVE-2025-13763","EUVD-2025-209564","GHSA-2v44-fq35-98vv","MGASA-2026-0224","UBUNTU-CVE-2025-13763","openSUSE-SU-2026:10475-1"],"status":"published","title":"Libopensc: opensc: multiple uses of uninitialized variable","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00265,"percentile":0.18616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-457"],"published":"2026-04-01T00:00:00Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Alpaquita:23","package":"opensc","fixed_in":["0.27.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"opensc","fixed_in":["0.27.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"opensc","fixed_in":["0.27.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensc","fixed_in":["0.27.0~rc1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0-r4"},{"fixed":"0.27.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-r0"},{"fixed":"0.27.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0-r4"},{"fixed":"0.27.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.0-0.3","0.23.0-0.3+deb12u1","0.23.0-0.3+deb12u2","0.23.0-1","0.23.0-2","0.24.0~rc1-1","0.25.0~rc1-1","0.25.1-1","0.25.1-2","0.25.1-2.1","0.26.0-1","0.26.1-1","0.26.1-2","0.26.1-3","0.27.0~rc1-1","0.27.0~rc2-1","0.27.1-1","0.27.1-2","0.27.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-2","0.26.1-3","0.27.0~rc1-1","0.27.0~rc2-1","0.27.1-1","0.27.1-2","0.27.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0~rc1-1"}]}],"versions":["0.26.1-2","0.26.1-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.0-1.2.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1","0.15.0-1ubuntu1+esm2","0.15.0-1ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1","0.17.0-3ubuntu0.1~esm2","0.17.0-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3","0.20.0-3ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.0-1ubuntu1","0.22.0-1ubuntu2","0.22.0-1ubuntu2+esm1","0.22.0-1ubuntu2.1","0.22.0-1ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.0-1ubuntu4","0.24.0~rc1-1","0.25.0~rc1-1","0.25.0~rc1-1build1","0.25.0~rc1-1build2","0.25.0~rc1-1ubuntu0.1~esm1","0.25.0~rc1-1ubuntu0.1","0.25.0~rc1-1ubuntu0.2","0.25.0~rc1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1","0.26.1-2","0.26.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.0~rc1-1","0.27.1-2","0.27.1-2ubuntu1","0.27.1-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-3","0.26.1-3ubuntu1","0.27.0~rc1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.1-1.1"}]}],"bundled":5}],"products":[{"vendor":"opensc","product":"opensc"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-13763","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2417581","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv","tags":["exploit","advisory","report"]},{"url":"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763","tags":["web","report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-13763","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13763.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13763","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-13763","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0224.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35319","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3VEH2KIGJ2SHJ7FWKNUDZSA2JUHQFRZS/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WSLOFM35Z6Y4PLTNF7MFB4JO2WJAIMX/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-13763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13763","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66215","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-13763","title":"Libopensc: opensc: multiple uses of uninitialized variable","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","status":"published","published":"2026-04-23T12:27:41.82Z","modified":"2026-11-06T14:46:11.554Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-457"],"updated_at":"2026-11-06T15:28:32.799664Z"}],"euvd":[{"id":"EUVD-2025-209564","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","status":"published","published":"2026-04-23T12:27:41Z","modified":"2026-11-06T14:46:11Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T16:05:20.373498Z"}],"nvd":[{"id":"CVE-2025-13763","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","status":"published","published":"2026-04-23T13:16:09.697Z","modified":"2026-11-06T15:17:04.727Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-457"],"updated_at":"2026-11-06T18:00:51.592332Z"}],"osv":[{"id":"BELL-CVE-2025-13763","status":"published","published":"2026-04-03T09:42:01.970004Z","modified":"2026-04-25T07:20:00.125595Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-13763","title":"Libopensc: opensc: multiple uses of uninitialized variable","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","status":"published","published":"2026-04-23T12:27:41.82Z","modified":"2026-11-08T02:31:07.066065264Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T03:07:55.437794Z"},{"id":"DEBIAN-CVE-2025-13763","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","status":"published","published":"2026-04-23T13:16:09.697Z","modified":"2026-11-07T09:47:36.79771767Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"UBUNTU-CVE-2025-13763","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","status":"published","published":"2026-04-23T13:16:00Z","modified":"2026-10-17T12:57:00.753556256Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"MGASA-2026-0224","title":"Updated opensc packages fix security vulnerabilities","description":"CVE-2025-66038 Memory corruption via improper compact-TLV length\nvalidation\nCVE-2025-66215 Stack-buffer-overflow with physical access via crafted\nsmart card or USB device\nCVE-2025-49010 Stack-buffer-overflow via crafted smart card or USB\ndevice responses\nCVE-2025-66037 Out-of-bounds read via crafted input\nCVE-2025-13763 Several uses of potentially uninitialized memory detected\nby fuzzers\n","status":"published","published":"2026-06-18T21:28:22Z","modified":"2026-06-18T21:30:04.514398594Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10475-1","title":"opensc-0.27.1-1.1 on GA media","description":"These are all security issues fixed in the opensc-0.27.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-01T00:00:00Z","modified":"2026-04-02T13:31:00.018388Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}