CVE-2025-66037: OpenSC: Out of Bounds vulnerability
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzzpkcs15reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, scpkcs15pubkeyfromspkifields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
azurelinux/openscto a version that resolves this vulnerability.Fixed in 0.27.1-1 - Upgrade
Upgrade
azurelinux/openscto a version that resolves this vulnerability.Fixed in 0.23.0-6 - Upgrade
Upgrade
OpenSCto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66037?
CVE-2025-66037 has a high severity rating due to potential for remote exploitation through crafted input.
How do I fix CVE-2025-66037?
To resolve CVE-2025-66037, upgrade OpenSC to version 0.27.0 or later.
What systems are affected by CVE-2025-66037?
CVE-2025-66037 affects OpenSC versions prior to 0.27.0.
What type of vulnerability is CVE-2025-66037?
CVE-2025-66037 is classified as an out-of-bounds vulnerability.
What might happen if CVE-2025-66037 is exploited?
Exploitation of CVE-2025-66037 could lead to unauthorized heap read access, potentially allowing an attacker to execute arbitrary code.