Medium severity · published Mar 30, 2026
CVE-2025-66037
OpenSC: Out of Bounds vulnerability
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenSC · OpenSC
< 0.27.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66037
Exploit
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-m58q-rmjm-mmfx
Vendor Advisory
https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66037
More from OpenSC
7.8
CVE-2026-40528
OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c
6.8
CVE-2026-40510
OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c
6.8
CVE-2025-66215
OpenSC: Stack-buffer-overflow WRITE in card-oberthur
6.8
CVE-2025-66038
OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers
6.8
CVE-2025-49010
OpenSC: Stack-buffer-overflow WRITE in GET RESPONSE