PT-2026-44840 · Opensc · Opensc

Nicholas Carlini · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-40510

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0-rc1

Description A stack buffer overflow exists in the piv process history() function within src/libopensc/card-piv.c. This issue allows a physically present attacker to cause memory corruption by using a specially crafted PIV smart card or USB device. The trigger occurs when the device returns a URL field exceeding 118 bytes in the Key History Object ASN.1 response.

Recommendations Update to version 0.27.0-rc1 or apply the fix from commit 3f24f0b.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-40510

Affected Products

Opensc

References · 5

• https://github.com/OpenSC/OpenSC/commit/3f24f0b48a481a8cf2e46059d8238a283ddc1c13 · Patch
• https://github.com/OpenSC/OpenSC/pull/3558 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40510 · Security Note
• https://vulncheck.com/advisories/opensc-stack-buffer-overflow-via-piv-process-history-in-card-piv-c · Note
• https://t.me/CVEtracker/55259 · Telegram Post