CVE-2025-66038 OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers
Attackers can trigger out-of-bounds pointer returns in OpenSC via crafted smart card data, potentially leading to memory corruption and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66038?
CVE-2025-66038 is a low-severity memory corruption vulnerability in Opensc Project Opensc, published on 30 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a 1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.
Weakness: CWE-126
Which versions are affected by CVE-2025-66038?
It affects 1 product.
Products include Opensc Project Opensc.
How do I fix CVE-2025-66038?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-66038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66038 exists.
Other vulnerabilities in Opensc Project Opensc
Sources
Also known as AZL-81192, BELL-CVE-2025-66038, DEBIAN-CVE-2025-66038, GHSA-72x5-fwjx-2459, UBUNTU-CVE-2025-66038.