CVE-2026-40528

opensc: OpenSC: Memory corruption via crafted profile configuration file

Loading…

Severity

Moderate

Red Hat Product Security

6.7

CVSS 3.1

Review impact separately from score.

Published · May 29, 2026

Updated · July 3, 2026

Description

A flaw was found in OpenSC. A local attacker can exploit this vulnerability by supplying a specially crafted profile configuration file to the pkcs15-init utility. This can lead to a stack and heap buffer overrun, allowing the attacker to corrupt memory. This memory corruption could potentially result in a denial of service or other unpredictable system behavior.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')