{"id":"CVE-2025-66215","summary":"OpenSC: Stack-buffer-overflow WRITE in card-oberthur","details":"OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.","aliases":["GHSA-q5fc-cw56-hwp2"],"modified":"2026-07-07T18:51:23.682456Z","published":"2026-03-30T17:06:16.996Z","related":["SUSE-SU-2026:1477-1","SUSE-SU-2026:21283-1","SUSE-SU-2026:21320-1","SUSE-SU-2026:22114-1","SUSE-SU-2026:22126-1","SUSE-SU-2026:2657-1","SUSE-SU-2026:2678-1","SUSE-SU-2026:2697-1","openSUSE-SU-2026:10475-1","openSUSE-SU-2026:20967-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66215.json"},"references":[{"type":"WEB","url":"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66215.json"},{"type":"ADVISORY","url":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66215"},{"type":"FIX","url":"https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d"},{"type":"FIX","url":"https://github.com/OpenSC/OpenSC/pull/3436"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opensc/opensc","events":[{"introduced":"0"},{"fixed":"aca07679a6dd281ee6411f5e7de2ed0ee796bee8"},{"fixed":"efd1d479832141bcf705c2f47655ada4d5f92f5d"}],"database_specific":{"cpe":"cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*","source":["CPE_RANGE","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.27.0"}]}}],"versions":["0.27.0-rc2","tag-test","0.27.0-rc1","0.26.0","0.26.0-rc1","0.25.0","0.25.0-rc1","0.24.0","0.24.0-rc2","0.24.0-rc1","0.23.0","0.23.0-rc2","0.23.0-rc1","0.22.0","0.22.0-rc2","0.22.0-rc1","0.21.0","0.21.0-rc2","0.21.0-rc1","0.20.0","0.20.0-rc4","0.20.0-rc3","0.20.0-rc2","0.20.0-rc1","0.19.0","0.19.0-rc1","0.18.0","0.18.0-rc2","0.18.0-rc1","0.17.0","0.17.0-rc2","0.17.0-rc1","0.16.0","v0.16.0-pre1","0.15.0","0.14.0","0.14.0rtm","0.14.0rc2","0.13.0","0.13.0rc1","0.13.0pre1","v0.12.2","0.12.2","0.12.2-rc1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-66215.json","vanir_signatures":[{"deprecated":false,"target":{"file":"src/libopensc/card-oberthur.c"},"source":"https://github.com/opensc/opensc/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d","id":"CVE-2025-66215-94f6e98e","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["275660614857694826234937081423223890640","27270751974049701868905245349700401826","50313016952931864561398515705558168827","104688020142064759906566567606033993645","228993640544972537306739289407473290774","192679885962287050345873215745461930623","131257578459671326022067542253683006268","322467172959384461285189609854716912553","300012682066173920886200470914274820873","174721223779700620828365326939677422741","38283113043268980949086407377446585819","35478391766041545343583183999104854129","200583321541503981482933969980330559814","244232887198185410793009517296095327063","52031491598704401709394271170463830303","49685429093214370179751653402491537731","195752748570927041583008193319226211031","339016234040350550556787235539063822139","5702662798046728584313952421750973160","135385094966676215069593605926453850997","132813857845216341687077110053205307214","304618392509078996305125789407223075652","218757245782352134909345645904266781221","168800931326058196618990183879391392556","241232765988456781249986258710075914715","162716243411674457816638117155259043112","272066353404987562441030002788592920882","183754240005129949253804688166596945215","48234691597787685932965373252590681788","171953180370964266074925808537756209127","255186881487948336793693971868472988804","334454992420437920126870833992816394836","155214824829189105464111403878754383393","256769696363580185276707614588518101262","299197116087606983460170730212326800237","273752797685621163042209753197193521705","272375516192474106364615061797906624027","255186881487948336793693971868472988804","334454992420437920126870833992816394836","317669130940110870947219736324088759796","9542902110272250969938233716533475819","126027900176770240037240610389735592980","336811591811170192961389661134883685200","183792994948800243183938535377254962776","115545620027790272252703671204600891330","93377022056499021009912795677855941656","320431734400757468585007917542750215549","266855322597667885874083290504036086512","64902624035202209668327520407216454495","307493359895774451033708434263461236935","129740875356891926932293016968824113147","110127376906206384753318726473224601806","238779164710097707871082775414525795753","153189119645379851446135274277838338466","55046799943865171467616136618113686321","330505416608397510177943005242305002082","25968888253145093835333905424737282412","310118590638354393379782385550966435265","171860838859579423331654218141011624500","306544353613342393241853194435966133283","159365135295020060875389971454896644270","211653682144285725232012846171832065492","94827683674817442520554597722130066480","33453282119902698686955276361428960004","168680979948713377882277963130101230607","179567974875591621483630515627152967285","18675237222000184349633871479046249246","66378830535727460407464071149600562080","161112263205421408556046463310083620863","22692559639412088760884465366233565229","71703672337376140377297376862675329852","261416386903991115722933224654623054252","319671902089793868508018634837465781716","147694860440234857826192643239126451515","54802552128760249763019311187725627190","329386249299062769125818163010284278527","55690320157301814416250618514716402528","105381309510283060408516343017020552888","122460484951037511887700187498805543051","163436822489263090978984584805521543472","329105852803336401789571584751954793453","178891434911436298172478957057014081242","331245170134197512600434163272177063450","103624883655453766728606715815545134686","219431225996515157352235108574570171607","6377609802815201024209885156757289177","200871583030337767185382755040412974281","42394064829607879248341759566522472264","171928729072593158572427795942233739914","94594362031934790739588344516324764989","305364209085064341552076840209874216070","263135661813953545544721285816526360956","304275446463392199362237961939257611884","247559885773333837424396991545272523697","142360414048169575595385201530219759333","113245084104527358842407032883418612529","268800311754335587757925154269112659960","179042922327440987798870883622091430498","245387196356093008221559009186826404783","231503224178658376776074751562927778987","158515193053369425740398558175726707131","109405398439613025036827125201245195660","126995045463265358086358334509826540566","206076918415118556985335467624483402708","152161620400340612242058822411980676762","313061614497929497052231764542307949703","49685429093214370179751653402491537731","96290290067514812696562549579373681120","171662939300127103390361600038938382888","100661380533289441069677006824942902244","167993910923543953941757797499595772207","253533181500023220382425220972687756729","167184816333788215548196513632770471701","263803570461731542904690916679203075577","256635602958254847772559551299410373408","320869861286427852884516501245945655930","146254039419342732657426122284014701063","205739972041529923800470552022762519131","282497340464693196621602202856722002028","67586745621174369263056254058931863111","204685312703662307499465327752573815768","139530088366179897120443421823640689268","255473857976848059110252619209010725915","259753891214520723258808746942387431925","258761785638014632615291821597109827572","316497548635682714625140980545110235110","31752844758331708884804411151578326453","14371716456184020604212552075056185027","255147886537627486037435211190392179535","42698013557770665645906118637933778647","90732069937623612572993965033635027931","290374577346017688229760928553120181049","109276743703313575069838336101507007595","301398371952714748439300531809929632972","270083304269885131100199980664821504438","5947541269591773630483353598016495483","298837264072921595381199599742875187985","232508766546156813047452452805069761470","113661131065092776100095412335596893800","286210433379750339024495542158441891805","33980126963216080725641922452824655911","109688288304350441548077065630444766835","318312547761321222605752843335862474082","328391093165928563192688004353025041878","96426341545407233937652142242958872889","87374849345201616410652966629820480325","272801653430660632584379040963196347737","160839595757664862987149920865369159577","237110816850462280852393779670647638426","41093898905586015739369001929759643280","240682736446324014415877329688735457292","204797349003055013585482353649326579217","295503349123918451472334640696275332752","199344357801852021213791794820422502869","212186884742871489922128714572627411074","26887598815110359747513119138751723247","41093898905586015739369001929759643280","240682736446324014415877329688735457292","119116402523310995411304082670685967756","197573276889267498191476187607242186347","162178848606037513830982265080526297093","240840368123521148616227641813091386073","17866909325829740028610231603594453485","253519312995711054896498785835275844759","94144128688377533765625301785508481490","287156163792762546394757721746381578800","232624592206593723794603747669911275633","250691846162144487305333434497875049038","110465492490223817778021849941339841037","258739519920183794653060163203383905877","209451531761541800417692232246870928360","125676615885485386139766981316211294558","10059453763113309872947961499501663568","337092111759590713784060447668818573715","73685800592434590344792368399041786118","160549992608572716037377244338999772698","326336321012117302503616199067169930119","213533995812356018761459219487237330542","146265447712875682850553270660658553217","306318613196138180746701383292294311925","223099631249146064682458896411299745458","205385515657353412921403896310057211419","297012889215827328893310560951855590362","206242082055786893898664132437882467937","171108395404437401233115803976905640664","127098304054254747221293035693417422905","220106143034433636648051042576565819521","36604693689925874112525611252265820294","50383977439304011752080255805684666538","58026694460897838171604972759205380373","124721514586905710602025758528303565227","334434231045497072464601770930154900258","101841685244278419639987121508768189334","203870475522934323169327107016296538196","224531640170972663648621321546846658267","50308746996476806868311174560355532872","317668238485835774531090754280331082051","305953451487225980784993577556342737758","123921692657092582740542262309623962396","7243401417787773395246083632140267764","64383469567713128067073485221027788890","29474901167751526691090311843685680846","19345406017552716185519384871600240825","122807953867985558737829745478953768234","44398528416532137880224952655311854406","226805285464287182364360417013398043413","246984942907970540263044701978748580836","151969637615030983508875013521994643996","200437812596387851871900474112038678664","339245231739798105530122668731103299201","268573531672660137659983002268201165309","222264016360814365038998175486747644252","306208702658438420183318020589059230849","128651245061331450043045683060428241013","276274685819765619845259096026150033075","3500074385075853360900731857318152380","189791203882432567396507524705250239052","127573854634910804713417657280238590929","333249296719977420917546454380293036946","331863077342201291374684202048624480955","62160754743965727176033486006316738355","276274685819765619845259096026150033075","290320722620315625669807007268277416666","72467733457075366981017379293546207627","243888318408206902837724253294656121064","217416376908778277203468959364725051468","155608458866989077044126076485270055514","81407762673131026067729938461878631847","96015457155796955857171704502071588247","208944967220687319921720462567293819749","21919002393502328768773705234533713923","210026178272670343566943091161504539809","26009637616368161973865717650048583792","154524559144535356934941935068992884441","168427463580188163479511870604413225570","266859116742458577282704658528654405092","92815442567871196334913987046949577700","106433466550346310110321051653238056237","60260209710954260802715418217129895867","271200212087381120750397146875548648094","135507758699175620575126576837743367843","32048214896518212138301082207528448611","45616114646886108877990597274159096384","311538920029125500806067775010867137688","115663545899647888682703268923014811849","212089352563421289178405430268978057595","170993483941854635283473717679387668023","50193276831195779777258178651675702125","266057125852969196054414471657317668648","115410326727434583482710245736312388307","284245882386992817522124332281812143143","219774695251823345463861090142920419837","322505998000845194520718700661707427729","234344479433384285043514954791183077329","170782253775747459728270352584279928144","86351103207250134970954574794467652393","105677638631613721768766996142696424691","95787223346690097488597527960473974929","178153055943905376238223143687636292586","283019527957406469252130036229245685883","102572777066806012651038721868059464355","115955908125991830715869187473603800367","247968170413365699154830342327747871340","87432613807267987836528086981314642944","1790357170674874829861446455486704789","98156660187964484792291726561214363835","255702678506373215266045175733396345321","100587797488439805745479659900926000701","302704746007258063309098592664737508892","286124554347180671058448288039332592846","315315183590810115518081522977183985948","18149311775124786097941409419968259203","15129635550835385038740438418224457469","271602120105988729388923255963720449153","151647137041258151313561585221498257175","110856413643163736590514284519191823267","157568557117868332809495441393508852782","49177941032569027933776511098590092223","69632832814242514057852611276520286432","315971181968702752900553862005903062210","168162574064215825091837059824970701254","31170030002182508725533769839924356316","98980002420950456203584348892935395041","127987045258772582806315049267477355235","277819402823997860801148414533394260709","88977455676480822421970160179840747739","182571777846816686028572625182566271467","286610645638391494968973257260246974177","290529558114964172432025370989079504690","302226258628299745854881564827393670528","61959736029056288078892031720258575102","339931682897236859371038880496063569628","225588672280520597694055916663667612171","300706940102066216907791289138873903288","128340251077476614130884010324991814173","25366147421874813899443223162080623786","198448459337898691225187024011571238804","338641705484658975840296878310152809757","269626080808717064707963167942710985687","293368057510908553700205531433956369000","193712935340560158649630056095734347189","101449343610150983538851869014625068058","111522689528484194723488639558133909282","126917802528977038521203117392546841499","178145733724657608576091121528076802446","192789366078620005054250072912726319285","187896177429165035981179947557253981332","127321268344694249044718598585456775025","274021708857216628244193002670483990941","241646060515866945825074015787192866185","279964227663550140926628705109439699192","232674013160247411918984901486216398134","198277525540585586241415024682342792696","335645680520282190474469252931591608296","63235377544060881957752041853790313447","36677132040818480316700299511474693523","209404362689448352562835302823396450503","265286129091753032293603331984587514268","83763811217147650959621874402160495356","44909055873218111279959713526804848035","320623176495504787537346182655291939038","211414588306633758825973236212563430444","272445834267527836038627382222827393426","229500551998010353190179976638410110508","288286780808539077365871354843345625740","6632913772289638843325825363584033967","129174867119006949918284530716216332114","323212903272816795345733932428555167488","326517854673627611342232963182125493515","90962929390984454576857319440817166001","105998639897881093833771223673999198195","144847736804440058020061330066069417245","250109488736140266259867200576488732400","328935464558114878013037789452209921914","222667914735598032224245606463177405676","52789160582995328527203941325700240644","313049082027745190112351022023255941692","151566839223801883932458826466879082549","73586845523970232494445827050225364885","319795136721151776105373559259630315402","329538455903577385429772385333415178246","334963526807724660841875315920405805075","331250964956018075586609732887222545416","6753788109374115579639833619868651549","81127756985978731598832316515183809566","144847736804440058020061330066069417245","250109488736140266259867200576488732400","298166258314204522987322356022424913469","169898494659534824880780303280771541408","260188150518071215402705420010942206157","44951874840542430275902773670814884160","205632663674013543193257808154788399944","4778522898561967260058270087630105691","296093416181759007650769114360304586997","91468411485728117596513204636682945352","189662130897109204013289846975484646704","305141523834901147846525585852793580336","91988178866264882537179670243584991029","224251454019088376682914203418386513602","22080418677352074107190284570490373401"]},"signature_type":"Line"}],"vanir_signatures_modified":"2026-07-07T18:51:23Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}]}