How severe is CVE-2010-4530?

CVE-2010-4530 has a CVSS 2.0 base score of 4.4, rated medium severity.

Is CVE-2010-4530 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2010-4530?

CVE-2010-4530 affects Muscle Pcsc-lite. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2010-4530?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2010-4530 published?

CVE-2010-4530 was published on 2011-01-18 and last updated on 2026-06-16.

CVE-2010-4530

CVE-2010-4530 is a medium-severity vulnerability in Muscle Pcsc-lite with a CVSS 2.0 base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-189.

Key facts

Severity: Medium (CVSS 2.0 base score 4.4)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-189
Affected product: Muscle Pcsc-lite
Published: 2011-01-18
Last modified: 2026-06-16

Description

Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation, which triggers a buffer overflow. NOTE: some sources refer to this issue as an integer overflow.

Frequently asked questions

What is CVE-2010-4530?: Signedness error in ccid_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 and possibly other products, allows physically proximate attackers to execute arbitrary code via a smart card with a crafted serial number that causes a negative value to be used in a memcpy operation, which triggers a buffer overflow. NOTE: some sources refer to this issue as an integer overflow.
How severe is CVE-2010-4530?: CVE-2010-4530 has a CVSS 2.0 base score of 4.4, rated medium severity.
Is CVE-2010-4530 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2010-4530?: CVE-2010-4530 affects Muscle Pcsc-lite. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2010-4530?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2010-4530 published?: CVE-2010-4530 was published on 2011-01-18 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:muscle:pcsc-lite:1.5.3:*:*:*:*:*:*:*

More vulnerabilities in Muscle Pcsc-lite

CVE-2016-10109 — High (CVSS 7.5): Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash)…
CVE-2010-0407 — Medium (CVSS 6.8): Multiple buffer overflows in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka…
CVE-2009-4902 — Medium (CVSS 6.8): Buffer overflow in the MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in…
CVE-2010-4531 — Medium (CVSS 4.4): Stack-based buffer overflow in the ATRDecodeAtr function in the Answer-to-Reset (ATR) Handler (atrhandler.c) for pcscd…
CVE-2009-4901 — Low (CVSS 2.1): The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite…

All CVEs affecting Muscle Pcsc-lite →

Other CWE-189 (Numeric Errors) vulnerabilities

CVE-2015-8396 — Critical (CVSS 10.0): Integer overflow in the ImageRegionReader::ReadIntoBuffer function in…
CVE-2015-7205 — Critical (CVSS 10.0): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x…
CVE-2015-6575 — Critical (CVSS 10.0): SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which…
CVE-2015-3864 — Critical (CVSS 10.0): Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in…
CVE-2015-3836 — Critical (CVSS 10.0): The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1…
CVE-2015-3834 — Critical (CVSS 10.0): Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android…

Browse all CWE-189 (Numeric Errors) vulnerabilities →