Vulnerability · Published Mar 30, 2026 · Assigned by GitHub_M
CVE-2025-49010OpenSC: Stack-buffer-overflow WRITE in GET RESPONSE
Low 3.8
In plain English
A low-severity stack buffer overflow in OpenSC from OpenSC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | opensc | no fix listed | DEBIAN-CVE-2025-49010 |
| Debian:13 | opensc | no fix listed | DEBIAN-CVE-2025-49010 |
| Debian:14 | opensc | 0.27.0~rc1-1 | DEBIAN-CVE-2025-49010 |
| Ubuntu:25.10 | opensc | no fix listed | UBUNTU-CVE-2025-49010 |
| Ubuntu:26.04:LTS | opensc | no fix listed | UBUNTU-CVE-2025-49010 |
| Ubuntu:26.10 | opensc | no fix listed | UBUNTU-CVE-2025-49010 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5cf-5wmx-9wh4 x_refsource_CONFIRM
- https://github.com/OpenSC/OpenSC/wiki/CVE-2025-49010 x_refsource_MISC