CVE-2025-49010: opensc_project opensc Stack-based Buffer Overflow
Vulnerability summary
CVE-2025-49010 is a medium (CVSS 6.8) Stack-based Buffer Overflow vulnerability in opensc_project opensc. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 30-03-2026PublishedVulnerability first disclosed.
- 30-03-2026Last modifiedVulnerability information updated.
Description
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA3.8LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.13% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- openscAll versions (No fix recorded) | < 0.27.0~rc1-1
Opensc1 product
- opensc< 0.27.0
Opensc_project1 product
- opensc< 0.27.0
Ubuntu1 product
- openscAll versions (No fix recorded)
4 vendors · 4 products
