CVE-2026-40528
published 2026-05-29CVE-2026-40528: OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.15%
4.3th percentile
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opensc | opensc | < 0.27.0 | 0.27.0 |
| opensc | opensc | < 0358817ec74aeca654f83e7709c7720b14c5db59 | 0358817ec74aeca654f83e7709c7720b14c5db59 |
| opensc_project | opensc | < 0.27.0 | 0.27.0 |
| opensc_project | opensc | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.01.0LOWCVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vxjj-52h8-95w5: OpenSC before 0
ghsa_unreviewed·2026-05-29
CVE-2026-40528 [LOW] CWE-121 GHSA-vxjj-52h8-95w5: OpenSC before 0
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.
Red Hat
opensc: OpenSC: Memory corruption via crafted profile configuration file
vendor_redhat·2026-05-29·CVSS 7.8
CVE-2026-40528 [HIGH] CWE-120 opensc: OpenSC: Memory corruption via crafted profile configuration file
opensc: OpenSC: Memory corruption via crafted profile configuration file
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.
A flaw was found in OpenSC. A local attacker can exploit this vulnerability by supplying a specially crafted profile configuration file to the `pkcs15-init` utility. This can lead to a stack and heap buffer overrun, allowing the attacker to corrupt memory
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-40528 opensc: OpenSC: Memory corruption via crafted profile configuration file [fedora-all]
bugzilla·2026-06-18·CVSS 7.8
CVE-2026-40528 [HIGH] CVE-2026-40528 opensc: OpenSC: Memory corruption via crafted profile configuration file [fedora-all]
CVE-2026-40528 opensc: OpenSC: Memory corruption via crafted profile configuration file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-40528 opensc: OpenSC: Memory corruption via crafted profile configuration file
bugzilla·2026-05-29·CVSS 7.8
CVE-2026-40528 [HIGH] CVE-2026-40528 opensc: OpenSC: Memory corruption via crafted profile configuration file
CVE-2026-40528 opensc: OpenSC: Memory corruption via crafted profile configuration file
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.
2026-05-29
Published