CVE-2025-66215

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66215
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66215.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66215
Aliases
  • GHSA-q5fc-cw56-hwp2
Downstream
Related
Published
2026-03-30T17:06:16.996Z
Modified
2026-04-28T18:29:27.643945066Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
OpenSC: Stack-buffer-overflow WRITE in card-oberthur
Details

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

Database specific 
{
    "cwe_ids": [
        "CWE-121"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66215.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/opensc/opensc

Affected ranges

Type
GIT
Repo
https://github.com/opensc/opensc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
aca07679a6dd281ee6411f5e7de2ed0ee796bee8
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.27.0"
        }
    ]
}

Affected versions

0.*
0.12.2
0.12.2-rc1
0.13.0
0.13.0pre1
0.13.0rc1
0.14.0
0.14.0rc2
0.14.0rtm
0.15.0
0.16.0
0.17.0
0.17.0-rc1
0.17.0-rc2
0.18.0
0.18.0-rc1
0.18.0-rc2
0.19.0
0.19.0-rc1
0.20.0
0.20.0-rc1
0.20.0-rc2
0.20.0-rc3
0.20.0-rc4
0.21.0
0.21.0-rc1
0.21.0-rc2
0.22.0
0.22.0-rc1
0.22.0-rc2
0.23.0
0.23.0-rc1
0.23.0-rc2
0.24.0
0.24.0-rc1
0.24.0-rc2
0.25.0
0.25.0-rc1
0.26.0
0.26.0-rc1
0.27.0-rc1
0.27.0-rc2
Other
tag-test
v0.*
v0.12.2
v0.16.0-pre1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66215.json"