CVE-2025-66038 - Vulnerability Analysis

Overview

OpenSC < 0.27.0 contains a buffer over-read caused by improper validation of claimed value length in sc_compacttlv_find_tag, letting attackers influence out-of-bounds pointers leading to memory corruption, exploit requires untrusted input data.

Severity & Score

Impact

Attackers can cause memory corruption by influencing out-of-bounds pointers, potentially leading to crashes or code execution.

Mitigation

Update to version 0.27.0 or later.

References

• https://github.com/OpenSC/OpenSC/commit/6db171bcb6fd7cb3b51098fefbb3b28e44f0a79c
• https://github.com/OpenSC/OpenSC/security/advisories/GHSA-72x5-fwjx-2459
• https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner