CVE-2025-66038

CVE-2025-66038 is a low-severity vulnerability in Opensc Project Opensc with a CVSS 3.x base score of 3.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-126.

Key facts

Description

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.

Frequently asked questions

What is CVE-2025-66038?
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.
How severe is CVE-2025-66038?
CVE-2025-66038 has a CVSS 3.x base score of 3.9, rated low severity. It is exploitable over physical access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2025-66038 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-66038?
CVE-2025-66038 affects Opensc Project Opensc. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-66038?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-66038 have an EU (EUVD) identifier?
Yes. CVE-2025-66038 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-209127.
When was CVE-2025-66038 published?
CVE-2025-66038 was published on 2026-03-30 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Opensc Project Opensc

All CVEs affecting Opensc Project Opensc →

Other CWE-126 (Buffer Over-read) vulnerabilities

Browse all CWE-126 (Buffer Over-read) vulnerabilities →