CVE-2025-66215: opensc_project opensc Stack-based Buffer Overflow

Vulnerability summary

CVE-2025-66215 is a medium (CVSS 6.8) Stack-based Buffer Overflow vulnerability in opensc_project opensc. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.6% of scored vulnerabilities.

Timeline

1. 30-03-2026
   PublishedVulnerability first disclosed.
2. 31-03-2026
   Last modifiedVulnerability information updated.

Description

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).