Skip to content
Heist/ feed
Back to feed
Low

OpenSC: Out of Bounds vulnerability

Type: advisorySources: OSV

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-66037
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 04:13 UTC · Revision 1

Source evidence

OpenSC: Out of Bounds vulnerability

core-osv · Original source

Published 30 Mar 2026, 17:01 UTC

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.

osv:CVE-2025-66037
Complete source record
{
  "id": "c57e1a1f496dd7857e721c2d2bb98f3211d0a88e72c83b3d9ad59ec918172fe8",
  "url": "https://osv.dev/vulnerability/CVE-2025-66037",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "OpenSC: Out of Bounds vulnerability",
    "summary": "OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.",
    "evidence": "osv:CVE-2025-66037",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2025-66037",
      "aliases": [
        "CVE-2025-66037",
        "GHSA-m58q-rmjm-mmfx"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/opensc/opensc",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "aca07679a6dd281ee6411f5e7de2ed0ee796bee8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.27.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.27.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.27.0-rc2",
            "tag-test",
            "0.27.0-rc1",
            "0.26.0",
            "0.26.0-rc1",
            "0.25.0",
            "0.25.0-rc1",
            "0.24.0",
            "0.24.0-rc2",
            "0.24.0-rc1",
            "0.23.0",
            "0.23.0-rc2",
            "0.23.0-rc1",
            "0.22.0",
            "0.22.0-rc2",
            "0.22.0-rc1",
            "0.21.0",
            "0.21.0-rc2",
            "0.21.0-rc1",
            "0.20.0",
            "0.20.0-rc4",
            "0.20.0-rc3",
            "0.20.0-rc2",
            "0.20.0-rc1",
            "0.19.0",
            "0.19.0-rc1",
            "0.18.0",
            "0.18.0-rc2",
            "0.18.0-rc1",
            "0.17.0",
            "0.17.0-rc2",
            "0.17.0-rc1",
            "0.16.0",
            "v0.16.0-pre1",
            "0.15.0",
            "0.14.0",
            "0.14.0rtm",
            "0.14.0rc2",
            "0.13.0",
            "0.13.0rc1",
            "0.13.0pre1",
            "v0.12.2",
            "0.12.2",
            "0.12.2-rc1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66037.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.901258969Z",
      "provider": "osv",
      "references": [
        "https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66037",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66037.json",
        "https://github.com/OpenSC/OpenSC/security/advisories/GHSA-m58q-rmjm-mmfx",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-66037"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-125"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66037.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-66037",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492410,
  "published_at": "2026-03-30T17:01:27.79+00:00"
}