Buffer Over-read in OpenSC - CVE-2025-66038

Vulnerability details

The vulnerability allows an attacker with physical access to disclose sensitive information, modify memory, or cause a denial of service.

The vulnerability exists due to out-of-bounds pointer return in sc_compacttlv_find_tag when parsing crafted compact-TLV data from untrusted cards or files. An attacker with physical access can provide a specially crafted compact-TLV buffer to disclose sensitive information, modify memory, or cause a denial of service.

The issue occurs because the function can return a pointer past the end of the buffer together with an unchecked length value, which may lead to downstream memory corruption when subsequent code dereferences the returned pointer.

Affected software

How to mitigate CVE-2025-66038

External References

• https://github.com/OpenSC/OpenSC/security/advisories/GHSA-72x5-fwjx-2459

Related Security Bulletins

• Multiple vulnerabilities in OpenSC
• Fedora 44 update for opensc
• Fedora 43 update for opensc
• Fedora 42 update for opensc
• SUSE update for opensc
• Anolis OS update for opensc