{"id":"CVE-2026-40510","aliases":["AZL-89150","CLSA-2026-1780711381","CLSA-2026-1781267272","EUVD-2026-33315","GHSA-7rrw-cv3r-3cgg","SUSE-SU-2026:23478-1","SUSE-SU-2026:23527-1","SUSE-SU-2026:23543-1","SUSE-SU-2026:23697-1","SUSE-SU-2026:23717-1","SUSE-SU-2026:4108-1","SUSE-SU-2026:4122-1","SUSE-SU-2026:4123-1","openSUSE-SU-2026:21820-1"],"status":"published","title":"OpenSC \u003c 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","severity":{"version":"4.0","score":1,"vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00294,"percentile":0.22175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-05-29T13:26:40Z","modified":"2026-11-09T02:47:16Z","fixes":[{"ecosystem":"Azure Linux:3","package":"opensc","fixed_in":["0.27.0-rc1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"opensc","fixed_in":["0.23.0-5.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"opensc","fixed_in":["0.24.0-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"opensc","fixed_in":["0.24.0-slfo.1.1_5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"opensc","fixed_in":["0.26.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"opensc","fixed_in":["0.26.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"opensc","fixed_in":["0.26.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"opensc","fixed_in":["0.13.0-3.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"opensc","fixed_in":["0.22.0-150400.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"opensc","fixed_in":["0.22.0-150400.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"opensc","fixed_in":["0.22.0-150400.3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"opensc","fixed_in":["0.22.0-150600.11.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"opensc","fixed_in":["0.26.1-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0-rc1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-2.el9_2.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-5.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.0-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.0-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150400.3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-150600.11.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"opensc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1-160000.4.1"}]}]}],"products":[{"vendor":"opensc","product":"opensc"},{"vendor":"opensc_project","product":"opensc"}],"references":[{"url":"https://github.com/OpenSC/OpenSC/pull/3558","tags":["issue-tracking","patch","Issue Tracking","Patch","fix"]},{"url":"https://github.com/OpenSC/OpenSC/commit/3f24f0b48a481a8cf2e46059d8238a283ddc1c13","tags":["patch","Patch","fix"]},{"url":"https://www.vulncheck.com/advisories/opensc-stack-buffer-overflow-via-piv-process-history-in-card-piv-c","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40510","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7rrw-cv3r-3cgg"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780711381.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40528","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781267272.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40510.json","tags":["advisory"]},{"url":"https://github.com/OpenSC/OpenSC","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623478-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266964","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40510","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623527-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623543-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623697-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623717-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264108-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264122-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264123-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40510","title":"OpenSC \u003c 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","status":"published","published":"2026-05-29T13:26:40.459Z","modified":"2026-11-08T14:02:53.357Z","cvss":[{"version":"4.0","score":1,"vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-33315","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","status":"published","published":"2026-05-29T13:26:40Z","modified":"2026-11-08T14:02:53Z","cvss":[{"version":"4.0","score":1,"vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-08T15:13:09.268962Z"}],"ghsa":[{"id":"GHSA-7rrw-cv3r-3cgg","title":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability...","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","status":"published","published":"2026-05-29T15:30:33Z","modified":"2026-05-29T15:30:38Z","cvss":[{"version":"4.0","score":1,"vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:08:22.826978Z"}],"nvd":[{"id":"CVE-2026-40510","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","status":"published","published":"2026-05-29T14:16:26.54Z","modified":"2026-07-21T12:10:00.09Z","cvss":[{"version":"4.0","score":1,"vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"CVE-2026-40510","title":"OpenSC \u003c 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","status":"published","published":"2026-05-29T13:26:40.459Z","modified":"2026-11-09T02:47:16.213297797Z","cvss":[{"version":"4.0","score":1,"vector":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-121"],"updated_at":"2026-11-09T03:16:17.543303Z"},{"id":"AZL-89150","title":"CVE-2026-40510 affecting package opensc for versions less than 0.27.0-rc1","description":"OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.","status":"published","published":"2026-05-29T14:16:26Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"CLSA-2026-1780711381","title":"opensc: Fix of 2 CVEs","description":"- CVE-2026-40510: stack buffer overflow in piv_process_history() via crafted PIV Key History Object\n- CVE-2026-40528: stack/heap buffer overrun in do_key_value() via overlong pkcs15init profile key value","status":"published","published":"2026-06-08T19:27:59Z","modified":"2026-10-26T09:30:17.675258417Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781267272","title":"opensc: Fix of CVE-2026-40510","description":"- CVE-2026-40510: fix possible stack buffer overflow when handling PIV history\n  object","status":"published","published":"2026-06-12T12:29:33Z","modified":"2026-10-26T09:31:08.095124261Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2026:21820-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-09T14:07:45Z","modified":"2026-09-12T18:23:08.112740557Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23478-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-08T10:28:42Z","modified":"2026-09-14T18:23:12.982985275Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23527-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-08T09:16:06Z","modified":"2026-09-15T18:23:09.840080888Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23543-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-09T13:45:21Z","modified":"2026-09-17T18:23:12.66308612Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23697-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-09T13:45:21Z","modified":"2026-09-29T18:23:21.317078173Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23717-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-09T13:45:21Z","modified":"2026-09-29T18:23:13.0974695Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4108-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-09T13:25:17Z","modified":"2026-09-14T18:23:15.690502121Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4122-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-10T11:46:35Z","modified":"2026-09-14T18:23:15.064753764Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4123-1","title":"Security update for opensc","description":"This update for opensc fixes the following issue:\n\n- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory\n  corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).\n","status":"published","published":"2026-09-10T11:47:06Z","modified":"2026-09-14T18:23:15.064853338Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}