CVE-2025-49010: OpenSC: Stack-buffer-overflow WRITE in GET RESPONSE
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that would present the system with specially crafted responses to the APDUs. This issue has been patched in version 0.27.0.
Other sources
OpenSC: Stack-buffer-overflow WRITE in GET RESPONSE
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.27.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.23.0-6 - Upgrade
Upgrade
OpenSCto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49010?
CVE-2025-49010 is considered a critical vulnerability due to the potential for stack-buffer overflow write attacks.
How do I fix CVE-2025-49010?
To mitigate CVE-2025-49010, upgrade OpenSC to version 0.27.0 or later to eliminate the vulnerability.
Who is affected by CVE-2025-49010?
CVE-2025-49010 affects users of OpenSC versions prior to 0.27.0 who use smart card tools with accessible tokens.
What type of vulnerability is CVE-2025-49010?
CVE-2025-49010 is a stack-buffer overflow vulnerability that can be exploited under specific physical access conditions.
Can CVE-2025-49010 be exploited remotely?
No, CVE-2025-49010 requires physical access to the affected computer to exploit the vulnerability.