CVE-2025-66215
⚪ Do wiadomości
Przepełnienie bufora w OpenSC umożliwia atakującemu zdalne wykonanie kodu.
CVSS
3.8
EPSS
0.0%
Exploit
none
Vendor
Opis źródłowy (NVD)
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 3.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-03-30 18:16:18 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-30 18:16:18 UTC |
Referencje
- https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d (security-advisories@github.com)
- https://github.com/OpenSC/OpenSC/pull/3436 (security-advisories@github.com)
- https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2 (security-advisories@github.com)
- https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215 (security-advisories@github.com)