CVE-2026-103531: OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcosconstructfci44 of the file src/libopensc/card-setcos.c. Executing a manipulation of the argument typeattr can lead to stack-based buffer overflow. The attack can be launched remotely. This patch is called ad730304052937c32b4eb489a06835ac6123632c. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSCto a version that resolves this vulnerability.Patch ad730304052937c32b4eb489a06835ac6123632c
Event History
Frequently Asked Questions
Which OpenSC releases are affected?
OpenSC versions up to and including 0.27.1 are affected.
What access and interaction does exploitation require?
The attack is described as remotely launchable. The supplied severity vector indicates low privileges are required and user interaction is required.
What component should be prioritized for remediation?
Prioritize the setcos_construct_fci_44 function in src/libopensc/card-setcos.c, where manipulation of the type_attr argument can trigger a stack-based buffer overflow. Apply patch ad730304052937c32b4eb489a06835ac6123632c.