OpenSC up to 0.26.x sc_compacttlv_find_tag buffer over-read

Summaryinfo

A vulnerability labeled as problematic has been found in OpenSC up to 0.26.x. This affects the function sc_compacttlv_find_tag. Such manipulation leads to buffer over-read. This vulnerability is traded as CVE-2025-66038. The attack can be executed directly on the physical device. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OpenSC up to 0.26.x. Affected by this issue is the function sc_compacttlv_find_tag. The manipulation with an unknown input leads to a buffer over-read vulnerability. Using CWE to declare the problem leads to CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-66038 since 11/21/2025. The exploitation is known to be difficult. The attack needs to be approached locally. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 304369 (Linux Distros Unpatched Vulnerability : CVE-2025-66038), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.27.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (304369). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• OpenSC

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26

License

• open-source

Website

• Product: https://github.com/OpenSC/OpenSC/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion