Skip to content
Fencer Vulns
low 3.9

CVE-2025-66038 json

OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers

published 2026-03-30 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-209127

cvss
3.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.

Patch / fix

  • opensc_project opensc 0.27.0
  • opensc Debian 14 0.27.0~rc1-1

debian advisories DEBIAN-CVE-2025-66038

  • opensc SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 0.22.0-150600.11.11.1
  • opensc SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 0.22.0-150400.3.17.1
  • opensc SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 0.26.1-160000.3.1
  • opensc SLE Micro 5.2 0.19.0-150100.3.34.1

suse advisories SUSE-SU-2026:2697-1SUSE-SU-2026:2657-1SUSE-SU-2026:22114-1SUSE-SU-2026:22126-1SUSE-SU-2026:1477-1

  • opensc openSUSE Leap 16.0 0.26.1-160000.3.1
  • opensc openSUSE Tumbleweed 0.27.1-1.1

opensuse advisories openSUSE-SU-2026:20967-1openSUSE-SU-2026:10475-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-66038 updated cvss 3.9

OpenSC: OpenSC: Memory corruption via improper compact-TLV length validation

  • Red Hat Enterprise Linux 7 opensc Red Hat Enterprise Linux 8 opensc Red Hat Enterprise Linux 9 opensc Red Hat Enterprise Linux 10 opensc
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenSC/OpenSC/security/advisories/GHSA-72x5-fwjx-2459 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • OpenSC OpenSC

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.