CVE-2026-40510— OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40510
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c
Source: CVE Program / CVE List V5
Vulnerability Description
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
OpenSC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSC是OpenSC开源的一款开源的智能卡工具和中间件。 OpenSC 0.27.0-rc1之前版本存在安全漏洞，该漏洞源于src/libopensc/card-piv.c中的piv_process_history()函数存在栈缓冲区溢出漏洞，允许物理存在的攻击者通过提供特制的PIV智能卡或USB设备，在Key History Object ASN.1响应中返回超过118字节的URL字段，从而触发内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-40510
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40510
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-40510 (2)
Vendor Advisories for CVE-2026-40510 (1)
IV. Related Vulnerabilities
Same product: OpenSC
- CVE-2026-10275
OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_c - CVE-2026-40528
OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile - CVE-2025-13763
Libopensc: opensc: multiple uses of uninitialized variable - CVE-2025-66215
OpenSC: Stack-buffer-overflow WRITE in card-oberthur - CVE-2025-66038
OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds po
Same vendor: OpenSC
- CVE-2026-40528
OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile - CVE-2025-13763
Libopensc: opensc: multiple uses of uninitialized variable - CVE-2025-66215
OpenSC: Stack-buffer-overflow WRITE in card-oberthur - CVE-2025-66038
OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds po - CVE-2025-66037
OpenSC: Out of Bounds vulnerability
Same weakness: CWE-121
- CVE-2026-54758
Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs - CVE-2026-73522
COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can( - CVE-2026-71979
INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Pa - CVE-2026-74843
Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingor - CVE-2026-19959
Edimax EW-7478APC formWanTcpipSetup stack-based overflow
V. Comments for CVE-2026-40510
No comments yet