CVE-2025-66215

Katalog CVE

CVSS 6.8 · Medium EPSS 0,16%

Kerentanan Stack-based Buffer Overflow pada opensc project opensc. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2 patch · advisory vendor
• https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215 advisory vendor
• https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d patch
• https://github.com/OpenSC/OpenSC/pull/3436 issue tracking · patch