Out-of-Bounds Heap Read Vulnerability in OpenSC by OpenSC
CVE-2025-66037
3.9LOW
What is CVE-2025-66037?
OpenSC is an open source project providing tools and middleware for smart card applications. A vulnerability was identified in versions preceding 0.27.0, where a maliciously crafted input to the fuzz_pkcs15_reader function could result in an out-of-bounds heap read associated with X.509/SPKI processing. This flaw occurs when the function sc_pkcs15_pubkey_from_spki_fields() attempts to access memory outside of its allocated buffer, specifically reading beyond a zero-length buffer allocation. This behavior could potentially allow an attacker to manipulate memory, leading to unauthorized information disclosure or system instability. OpenSC has addressed this issue in version 0.27.0.
Affected Version(s)
OpenSC < 0.27.0