CVE-2026-40528: OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c
OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the dokeyvalue() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSCto a version that resolves this vulnerability.Fixed in 0.27.0Patch 0358817 - Compensating control
If immediate upgrade is not possible, do not process or load untrusted/crafted OpenSC profile configuration files used by pkcs15-init (src/pkcs15init/profile.c do_key_value()).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40528?
The severity of CVE-2026-40528 is low with a CVSS score of 3.8.
How do I fix CVE-2026-40528?
To fix CVE-2026-40528, update OpenSC to version 0.27.0 or later.
What type of vulnerability is CVE-2026-40528?
CVE-2026-40528 is classified as a buffer overrun vulnerability.
What can an attacker achieve with CVE-2026-40528?
An attacker can corrupt memory by supplying a crafted profile configuration file due to the buffer overrun.
In which OpenSC versions is CVE-2026-40528 present?
CVE-2026-40528 is present in OpenSC versions prior to 0.27.0.