CVE-2026-40510: OpenSC stack buffer overflow in PIV card history processing

CVE-2026-40510 · Severity: low · CVSS 3.8 · Published 2026-05-29

OpenSC is an open-source library used to interface with smart cards and security tokens. A vulnerability exists where a specially crafted PIV smart card or USB device, when physically inserted into a system, can cause the software to crash or experience memory corruption. This could potentially allow an attacker with physical access to the hardware to interfere with the security operations of the connected computer.

Technologies: OpenSC Project OpenSC. Vendors: OpenSC Project.

Quick answers

Is CVE-2026-40510 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40510 being exploited in the wild.
How severe is CVE-2026-40510?
Low severity, with a CVSS score of 3.8, published 29 May 2026.
Which products and versions are affected?
OpenSC Project OpenSC < 0.27.0-rc1.
Is there a fix for CVE-2026-40510?
A patch was published on 2026-01-26: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40510 attacked?
It is attacked with physical access, in a software library.
Am I affected by CVE-2026-40510?
Check whether you run OpenSC Project OpenSC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the `piv_process_history()` function within `src/libopensc/card-piv.c`. The vulnerability is triggered when the library parses a Key History Object ASN.1 response from a PIV (Personal Identity Verification) device. If the device returns a URL field (tag 0xF3) longer than 118 bytes, it exceeds the allocated buffer space. An attacker with physical access can exploit this by presenting a malicious smart card or USB token. Successful exploitation results in memory corruption, which may lead to a denial of service or limited code execution in the context of the process using OpenSC. The issue was fixed in commit 3f24f0b by adding bounds checking on the `urllen` variable.

Affected products

  • OpenSC OpenSC < 0.27.0-rc1

Timeline

  • 2026-01-22: other: Initial patch submitted to GitHub
  • 2026-01-26: patched: Fix merged into master branch
  • 2026-05-29: disclosed: CVE published and NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.