CVE-2025-13763: Libopensc: opensc: multiple uses of uninitialized variable

Description

Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs

CVSS vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack vector

Physical

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 18% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OP

OpenSC · OpenSC

before 0.27.0 · source: vendor

RH

Red Hat Enterprise Linux 10 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 7 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 8 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 9 · Red Hat

All versions, or not specified · source: vendor