Back Linuxsecurity

Fedora 43 OpenSC Critical Memory Corruption Buffer Overflow 2026

Linuxsecurity •LinuxSecurity Advisories • April 9, 2026

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS#11 API so applications supporting this API (such as Mozilla Firefox and Thunderbird) can use it. On the card OpenSC implements the PKCS#15 standard and aims to be compatible with every software/card that does so, too. Update Information : New upstream release (#2442363) fixing various security issues:

OpenSC provides a set of libraries and utilities to work with smart cards. Its

main focus is on cards that support cryptographic operations, and facilitate

their use in security applications such as authentication, mail encryption and

digital signatures. OpenSC implements the PKCS#11 API so applications

supporting this API (such as Mozilla Firefox and Thunderbird) can use it. On

the card OpenSC implements the PKCS#15 standard and aims to be compatible with

every software/card that does so, too.

New upstream release (#2442363) fixing various security issues:

* Tue Mar 31 2026 Jakub Jelen - 0.27.1-1 - New upstream release (#2442363) fixing various security issues: - CVE-2025-66038 Memory corruption via improper compact-TLV length validation - CVE-2025-66215 Stack-buffer-overflow with physical access via crafted smart card or USB device - CVE-2025-49010 Stack-buffer-overflow via crafted smart card or USB device responses - CVE-2025-66037 Out-of-bounds read via crafted input - CVE-2025-13763 Several uses of potentially uninitialized memory detected by fuzzers

[ 1 ] Bug #2442363 - opensc-0.27.1 is available [ 2 ] Bug #2453188 - CVE-2025-66037 opensc: OpenSC: Out-of-bounds read via crafted input [fedora-all] [ 3 ] Bug #2453189 - CVE-2025-49010 opensc: OpenSC: Stack-buffer-overflow via crafted smart card or USB device responses [fedora-all] [ 4 ] Bug #2453190 - CVE-2025-66215 opensc: OpenSC: Stack-buffer-overflow with physical access via crafted smart card or USB device [fedora-all] [ 5 ] Bug #2453191 - CVE-2025-66038 opensc: OpenSC: Memory corruption via improper compact-TLV length validation [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-4440b00e25' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Memory Corruption Vulnerabilities in OpenSC Affecting Fedora Users OpenSC, a library for smart card operations, has released a new version addressing multiple critical vulnerabilities. The vulnerabilities include CVE-2025-66038, CVE-2025-66215, CVE-2025-49010, and CVE-2025-66037, all published on 2026-03-30. These issues involve memory corruption and stack-buffer overflows that can be exploited via crafted smart card or USB device inputs. Users of Fedora 42 and Fedora 43 are specifically affected, as the vulnerabilities could allow attackers with physical access to exploit the system. The release of OpenSC version 0.27.1-1 on 2026-03-31 aims to mitigate these risks. Security professionals are advised to update their systems promptly to avoid potential exploitation. The vulnerabilities were identified through fuzz testing, highlighting the importance of thorough security assessments in software development. 2 sources 71

Extracted Entities

CVEs (5)

CVE-2025-13763 CVE-2025-49010 CVE-2025-66037 CVE-2025-66038 CVE-2025-66215