How severe is CVE-2020-26570?

CVE-2020-26570 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2020-26570 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-26570?

CVE-2020-26570 primarily affects Opensc Project Opensc. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-26570?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-26570 published?

CVE-2020-26570 was published on 2020-10-06 and last updated on 2026-06-17.

CVE-2020-26570

CVE-2020-26570 is a medium-severity vulnerability in Opensc Project Opensc with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-787
Affected product: Opensc Project Opensc
Published: 2020-10-06
Last modified: 2026-06-17

Description

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.

Frequently asked questions

What is CVE-2020-26570?: The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
How severe is CVE-2020-26570?: CVE-2020-26570 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2020-26570 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-26570?: CVE-2020-26570 primarily affects Opensc Project Opensc. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-26570?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-26570 published?: CVE-2020-26570 was published on 2020-10-06 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

More vulnerabilities in Opensc Project Opensc

CVE-2021-34193 — High (CVSS 7.5): Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs.
CVE-2019-16058 — High (CVSS 7.5): An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a…
CVE-2019-6502 — High (CVSS 7.5): sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv.
CVE-2023-2977 — High (CVSS 7.1): A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15…
CVE-2019-20792 — Medium (CVSS 6.8): OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in…
CVE-2018-16393 — Medium (CVSS 6.8): Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in…

All CVEs affecting Opensc Project Opensc →

Other CWE-787 (Out-of-bounds Write) vulnerabilities

CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is…
CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…

Browse all CWE-787 (Out-of-bounds Write) vulnerabilities →