{"id":"CVE-2025-66038","aliases":["AZL-81192","BELL-CVE-2025-66038","CLSA-2026-1779190223","DEBIAN-CVE-2025-66038","EUVD-2025-209127","GHSA-72x5-fwjx-2459","MGASA-2026-0224","SUSE-SU-2026:1477-1","SUSE-SU-2026:21283-1","SUSE-SU-2026:21320-1","SUSE-SU-2026:22114-1","SUSE-SU-2026:22126-1","SUSE-SU-2026:2657-1","SUSE-SU-2026:2697-1","UBUNTU-CVE-2025-66038","openSUSE-SU-2026:10475-1","openSUSE-SU-2026:20967-1"],"status":"published","title":"OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00293,"percentile":0.22065,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-126"],"published":"2026-03-30T17:03:55Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpaquita:23","package":"opensc","fixed_in":["0.27.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"opensc","fixed_in":["0.27.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"opensc","fixed_in":["0.27.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensc","fixed_in":["0.27.0~rc1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.27.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0-r4"},{"fixed":"0.27.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-r0"},{"fixed":"0.27.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.22.0-r3"},{"fixed":"0.27.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-2.el9_2.tuxcare.els5"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.0-0.3","0.23.0-0.3+deb12u1","0.23.0-0.3+deb12u2","0.23.0-1","0.23.0-2","0.24.0~rc1-1","0.25.0~rc1-1","0.25.1-1","0.25.1-2","0.25.1-2.1","0.26.0-1","0.26.1-1","0.26.1-2","0.26.1-3","0.27.0~rc1-1","0.27.0~rc2-1","0.27.1-1","0.27.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-2","0.26.1-3","0.27.0~rc1-1","0.27.0~rc2-1","0.27.1-1","0.27.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0~rc1-1"}]}],"versions":["0.26.1-2","0.26.1-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.0-1.2.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-150100.3.34.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150600.11.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150600.11.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150600.11.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-1ubuntu1","0.15.0-1ubuntu1+esm1","0.15.0-1ubuntu1+esm2","0.15.0-1ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-1","0.17.0-2","0.17.0-2build1","0.17.0-3","0.17.0-3ubuntu0.1~esm1","0.17.0-3ubuntu0.1~esm2","0.17.0-3ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-2","0.20.0-1","0.20.0-2","0.20.0-3","0.20.0-3ubuntu0.1~esm1","0.20.0-3ubuntu0.1~esm2","0.20.0-3ubuntu0.1~esm3","0.20.0-3ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.0-1ubuntu1","0.22.0-1ubuntu2","0.22.0-1ubuntu2+esm1","0.22.0-1ubuntu2.1","0.22.0-1ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.0-1ubuntu4","0.24.0~rc1-1","0.25.0~rc1-1","0.25.0~rc1-1build1","0.25.0~rc1-1build2","0.25.0~rc1-1ubuntu0.1~esm1","0.25.0~rc1-1ubuntu0.1","0.25.0~rc1-1ubuntu0.2","0.25.0~rc1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1","0.26.1-2","0.26.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.0~rc1-1","0.27.1-2","0.27.1-2ubuntu1","0.27.1-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-3","0.26.1-3ubuntu1","0.27.0~rc1-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.3.1"}]}],"bundled":4}],"products":[{"vendor":"opensc","product":"opensc"},{"vendor":"opensc_project","product":"opensc"}],"references":[{"url":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-72x5-fwjx-2459","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/OpenSC/OpenSC/commit/6db171bcb6fd7cb3b51098fefbb3b28e44f0a79c","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038","tags":["x_refsource_MISC","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66038","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-66038","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779190223.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66038.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-66038","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0224.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35319","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3VEH2KIGJ2SHJ7FWKNUDZSA2JUHQFRZS/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WSLOFM35Z6Y4PLTNF7MFB4JO2WJAIMX/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261477-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261214","tags":["report"]},{"url":"https://bugzilla.suse.com/1261218","tags":["report"]},{"url":"https://bugzilla.suse.com/1261219","tags":["report"]},{"url":"https://bugzilla.suse.com/1261220","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66215","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621283-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621320-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622114-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622126-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262657-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266963","tags":["report"]},{"url":"https://bugzilla.suse.com/1267246","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40528","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262697-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-66038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66038","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13763","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-66038","title":"OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T17:03:55.914Z","modified":"2026-04-01T18:15:33.347Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-209127","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T17:03:55Z","modified":"2026-04-01T18:15:33Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T19:25:24.09733Z"}],"nvd":[{"id":"CVE-2025-66038","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T18:16:18.177Z","modified":"2026-06-17T09:56:13.423Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:12:01.641503Z"}],"osv":[{"id":"BELL-CVE-2025-66038","status":"published","published":"2026-03-31T06:09:06.9463Z","modified":"2026-04-07T07:15:34.574692Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-66038","title":"OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T17:03:55.914Z","modified":"2026-10-28T11:06:14.289778757Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"DEBIAN-CVE-2025-66038","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T18:16:18.177Z","modified":"2026-09-01T20:05:56.138055711Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-66038","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T18:16:00Z","modified":"2026-10-17T12:57:27.919657672Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"low"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"AZL-81192","title":"CVE-2025-66038 affecting package opensc 0.27.1-3","description":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.","status":"published","published":"2026-03-30T18:16:18Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1779190223","title":"opensc: Fix of 5 CVEs","description":"- CVE-2023-5992: implement constant-time PKCS#1 v1.5 depadding to prevent Bleichenbacher/Marvin-style timing attacks\n- CVE-2025-49010: fix stack buffer overflow write in iso7816 GET RESPONSE\n- CVE-2025-66037: fix out-of-bounds heap read in sc_pkcs15_pubkey_from_spki_fields\n- CVE-2025-66038: fix buffer over-read in sc_compacttlv_find_tag\n- CVE-2025-66215: fix stack buffer overflow write in card-oberthur auth_compute_signature and auth_read_record","status":"published","published":"2026-05-19T11:30:52Z","modified":"2026-06-01T00:32:34.147791695Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2026-0224","title":"Updated opensc packages fix security vulnerabilities","description":"CVE-2025-66038 Memory corruption via improper compact-TLV length\nvalidation\nCVE-2025-66215 Stack-buffer-overflow with physical access via crafted\nsmart card or USB device\nCVE-2025-49010 Stack-buffer-overflow via crafted smart card or USB\ndevice responses\nCVE-2025-66037 Out-of-bounds read via crafted input\nCVE-2025-13763 Several uses of potentially uninitialized memory detected\nby fuzzers\n","status":"published","published":"2026-06-18T21:28:22Z","modified":"2026-06-18T21:30:04.514398594Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10475-1","title":"opensc-0.27.1-1.1 on GA media","description":"These are all security issues fixed in the opensc-0.27.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-01T00:00:00Z","modified":"2026-04-02T13:31:00.018388Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20967-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n","status":"published","published":"2026-06-15T11:47:03Z","modified":"2026-06-24T18:24:20.770230243Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1477-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2025-49010: specially crafted smart card or USB device can lead to a stack buffer overflow write in\n  `GET RESPONSE` (bsc#1261214).\n- CVE-2025-66037: specially crafted input processed by the `fuzz_pkcs15_reader` harness can lead to an out-of-bounds\n  heap read in the X.509/SPKI handling path (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to the dereferecing of out-of-bounds pointers and\n  memory corruption (bsc#1261219).\n- CVE-2025-66215: specially crafted smart card or USB device can lead to a stack buffer overflow write in\n  `card-oberthur` (bsc#1261220).\n","status":"published","published":"2026-04-20T10:08:54Z","modified":"2026-04-21T08:15:13.325503Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21283-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n","status":"published","published":"2026-04-22T11:16:41Z","modified":"2026-04-28T18:24:28.86144Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21320-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n","status":"published","published":"2026-04-22T13:00:05Z","modified":"2026-04-28T18:26:25.800862Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22114-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n","status":"published","published":"2026-06-15T11:42:48Z","modified":"2026-06-17T18:24:20.454402023Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22126-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues:\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n","status":"published","published":"2026-06-15T11:42:48Z","modified":"2026-06-17T18:24:28.22063785Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2657-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n- CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation (bsc#1267246).\n- CVE-2026-40528: stack and heap buffer overrun in the `do_key_value()` function due to missing length check allows for\n  memory corruption via a crafted profile configuration file (bsc#1266963).\n","status":"published","published":"2026-06-26T12:25:06Z","modified":"2026-06-27T08:45:05.168365512Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2697-1","title":"Security update for opensc","description":"This update for opensc fixes the following issues\n\n- CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).\n- CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).\n- CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior (bsc#1261219).\n- CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).\n- CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation (bsc#1267246).\n- CVE-2026-40528: stack and heap buffer overrun in the `do_key_value()` function due to missing length check allows for\n  memory corruption via a crafted profile configuration file (bsc#1266963).\n","status":"published","published":"2026-06-30T09:15:07Z","modified":"2026-07-01T09:45:06.022800307Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}