Is CVE-2026-10275 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10275 being exploited in the wild.

How severe is CVE-2026-10275?

Medium severity, with a CVSS score of 5, published 1 June 2026.

Which products and versions are affected?

OpenSC Project OpenSC up to 0.26.1.

Is there a fix for CVE-2026-10275?

A patch was published on 2026-05-15: Fix merged into OpenSC master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10275 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10275?

Check whether you run OpenSC Project OpenSC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10275: OpenSC pkcs11-tool buffer overflow in test_kpgen_certwrite

CVE-2026-10275 · Severity: medium · CVSS 5 · Published 2026-06-01

OpenSC is an open-source suite of tools and libraries for interacting with smart cards and security tokens. A vulnerability in its pkcs11-tool component could allow a buffer overflow to occur during key generation or certificate writing operations. If exploited, this could lead to a service crash or potentially allow unauthorized code execution, though the attack is considered difficult to perform and requires specific user interaction.

Technologies: OpenSC Project OpenSC. Vendors: OpenSC Project.

Quick answers

Is CVE-2026-10275 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10275 being exploited in the wild.
How severe is CVE-2026-10275?: Medium severity, with a CVSS score of 5, published 1 June 2026.
Which products and versions are affected?: OpenSC Project OpenSC up to 0.26.1.
Is there a fix for CVE-2026-10275?: A patch was published on 2026-05-15: Fix merged into OpenSC master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10275 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10275?: Check whether you run OpenSC Project OpenSC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in OpenSC versions up to 0.26.1 within the pkcs11-tool utility. The flaw is located in the test_kpgen_certwrite function in src/tools/pkcs11-tool.c, where the application fails to properly validate the length of an object ID before copying it into a fixed-size buffer (opt_object_id). An attacker could exploit this by providing a specially crafted URI or object ID that exceeds the buffer's capacity. While the attack vector is listed as remote, it carries high complexity and requires user interaction. A patch has been merged into the master branch (commit 814f745) which adds explicit bounds checking against the size of the destination buffer.

Affected products

OpenSC OpenSC up to 0.26.1

Timeline

2026-05-11: disclosed: Issue reported on GitHub
2026-05-15: patched: Fix merged into OpenSC master branch
2026-06-01: advisory: CVE-2026-10275 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.