CVE-2026-40510: opensc_project opensc Stack-based Buffer Overflow

Vulnerability summary

CVE-2026-40510 is a medium (CVSS 6.8) Stack-based Buffer Overflow vulnerability in opensc_project opensc. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.9% of scored vulnerabilities.

Timeline

1. 29-05-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).