Vulnerability · Published Mar 30, 2026 · Assigned by GitHub_M

CVE-2025-66215OpenSC: Stack-buffer-overflow WRITE in card-oberthur

Low 3.8

In plain English

A low-severity stack buffer overflow in OpenSC from OpenSC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.2%top 94.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	opensc	no fix listed	DEBIAN-CVE-2025-66215
Debian:13	opensc	no fix listed	DEBIAN-CVE-2025-66215
Debian:14	opensc	0.27.0~rc1-1	DEBIAN-CVE-2025-66215
Ubuntu:25.10	opensc	no fix listed	UBUNTU-CVE-2025-66215
Ubuntu:26.04:LTS	opensc	no fix listed	UBUNTU-CVE-2025-66215
Ubuntu:26.10	opensc	no fix listed	UBUNTU-CVE-2025-66215

Affected products (as reported)

Vendor	Product	Versions
OpenSC	OpenSC	< 0.27.0

Weakness: CWE-121 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2 x_refsource_CONFIRM
https://github.com/OpenSC/OpenSC/pull/3436 x_refsource_MISC
https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d x_refsource_MISC
https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215 x_refsource_MISC