CVE-2025-66215

low-risk
Published 2026-03-30

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.8/10 Low
PHYSICAL / HIGH complexity

Affected Products (1)

Affected Vendors

Opensc Project

References (4)

Patch https://github.com/OpenSC/OpenSC/commit/efd1d479832141bcf705c2f47655ada4d5f92f5d
Issue Tracking https://github.com/OpenSC/OpenSC/pull/3436
Patch https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2
Vendor Advisory https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66215
15
/ 100
low-risk
Severity 10/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal