CVE-2023-40661Medium· 5.4▾ SunlitSeveral memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.3%
Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise key generation, certificate loading, and other card management operations during enrollment.
OpenSC < 0.24.0opensc (all versions)opensc (all versions)openscRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-40660Medium· 6.6Opensc: potential pin bypass when card tracks its own login state
CVE-2026-103531Medium· 5.5A flaw has been found in OpenSC up to 0.27.1
CVE-2024-1454Low· 3.4Opensc: memory use after free in authentic driver when updating token info
CVE-2023-5992Medium· 5.6Opensc: side-channel leaks while stripping encryption pkcs#1 padding
CVE-2025-13763Medium· 5.7Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash
CVE-2024-8443Low· 2.9A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver