OpenSC up to 0.26.x X.509/SPKI sc_pkcs15_pubkey_from_spki_fields out-of-bounds

Summaryinfo

A vulnerability identified as critical has been detected in OpenSC up to 0.26.x. Affected by this issue is the function sc_pkcs15_pubkey_from_spki_fields of the component X.509/SPKI. This manipulation causes out-of-bounds. This vulnerability appears as CVE-2025-66037. It is feasible to perform the attack on the physical device. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in OpenSC up to 0.26.x. Affected by this vulnerability is the function sc_pkcs15_pubkey_from_spki_fields of the component X.509/SPKI. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-66037 since 11/21/2025. The exploitation appears to be difficult. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 321602 (SUSE SLES16 Security Update : opensc (SUSE-SU-2026:22126-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.27.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (321602). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• OpenSC

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26

License

• open-source

Website

• Product: https://github.com/OpenSC/OpenSC/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion