Stack Buffer Overflow in OpenSC Affects Smart Card Processing

CVE-2026-40510

What is CVE-2026-40510?

A stack buffer overflow vulnerability exists in OpenSC versions prior to 0.27.0-rc1 within the piv_process_history() function. This vulnerability can be exploited by attackers who have physical access to a targeted system, allowing them to use specially crafted PIV smart cards or USB devices. These malicious devices can return a URL field longer than 118 bytes in the Key History Object ASN.1 response, leading to potential memory corruption.

References