CVE-2025-13763: OpenSC libopensc uninitialized variables in card detection

CVE-2025-13763 · Severity: medium · CVSS 5.7 · Published 2026-04-23

A vulnerability was found in OpenSC, a library used to interface with smart cards and USB security tokens. By using a specially modified USB device or smart card, an attacker could cause the software to crash or potentially leak sensitive information from the system's memory. This requires physical access to the computer to insert the malicious device.

Technologies: OpenSC Project OpenSC, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat In-Vehicle Operating System 1. Vendors: OpenSC Project, Red Hat.

Quick answers

Is CVE-2025-13763 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13763 being exploited in the wild.
How severe is CVE-2025-13763?
Medium severity, with a CVSS score of 5.7, published 23 April 2026.
Which products and versions are affected?
OpenSC Project OpenSC < 0.27.0.
Is there a fix for CVE-2025-13763?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13763 attacked?
It is attacked with physical access, in a software library.
Am I affected by CVE-2025-13763?
Check whether you run OpenSC Project OpenSC, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple instances of uninitialized variable usage (CWE-457) were identified in libopensc, specifically within card detection and parsing functions such as iasecc_process_fci, get_cert_len, and cac_is_cert. The vulnerability is triggered when the library processes specially crafted responses (APDUs) from a malicious USB device or smart card. An attacker with physical access can exploit these flaws to read uninitialized memory (information disclosure) or cause a denial-of-service (application crash). The issues were discovered via fuzzing and are addressed in OpenSC version 0.27.0.

Affected products

  • OpenSC OpenSC < 0.27.0
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat In-Vehicle Operating System 1

Timeline

  • 2025-11-27: disclosed: Initial report in Red Hat Bugzilla
  • 2026-03-30: advisory: GitHub Security Advisory published
  • 2026-04-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.