CVE-2026-40528
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
OpenSC before version 0.27.0 (fixed in commit 0358817) contains a stack and heap buffer overrun in the do_key_value() function in src/pkcs15init/profile.c. Attackers can supply a crafted profile configuration file, causing buffer overrun and memory corruption.
Risk Assessment
An attacker can cause memory corruption, potentially leading to arbitrary code execution or service crash.
Recommendation
Update OpenSC to version 0.27.0 or later.
Original NVD description (English source)
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.