QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-40510

Back to search

CVE-2026-40510

Published: May 29, 2026

Modified: Jun 1, 2026

PUBLISHED

CVSS v3.1

3.8

LOW

Description

OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.

VendorProductVersions

OpenSC

OpenSC

affected
0 - < 0.27.0-rc1
affected
0 - < 3f24f0b48a481a8cf2e46059d8238a283ddc1c13

Weaknesses (CWE)

CWE-121

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now