Executive brief
OpenSC is an open-source library used to interface with smart cards and security tokens. A vulnerability exists where a specially crafted PIV smart card or USB device, when physically inserted into a system, can cause the software to crash or experience memory corruption. This could potentially allow an attacker with physical access to the hardware to interfere with the security operations of the connected computer.
Technical details
A stack-based buffer overflow exists in the `piv_process_history()` function within `src/libopensc/card-piv.c`. The vulnerability is triggered when the library parses a Key History Object ASN.1 response from a PIV (Personal Identity Verification) device. If the device returns a URL field (tag 0xF3) longer than 118 bytes, it exceeds the allocated buffer space. An attacker with physical access can exploit this by presenting a malicious smart card or USB token. Successful exploitation results in memory corruption, which may lead to a denial of service or limited code execution in the context of the process using OpenSC. The issue was fixed in commit 3f24f0b by adding bounds checking on the `urllen` variable.
Affected products
- OpenSC OpenSC < 0.27.0-rc1
Timeline
- 2026-01-22: other: Initial patch submitted to GitHub
- 2026-01-26: patched: Fix merged into master branch
- 2026-05-29: disclosed: CVE published and NVD entry created