Disclosure summary
A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-setcos.c. Executing a manipulation of the argument type_attr can lead to stack-based buffer overflow. The attack can be launched remotely. This patch is called ad730304052937c32b4eb489a06835ac6123632c. It is best practice to apply a patch to resolve this issue.
Source-reported weakness categories
CWE-119, CWE-121
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-103531
Open original source · Updated Oct 05, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Microsoft Security Updates (CVRF) · 2026-Oct
Open original source · Updated Oct 01, 2026
OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.
Microsoft maximum product score: 5.5
| Vendor | Product / association | Version / bounds |
|---|---|---|
| Microsoft update guide | azl3 opensc 0.27.1-2 on Azure Linux 3.0 | (MSRC status code 3) |
Vendor remediation references
- Release Notes · product IDs 21490-17084
- Vendor guidance · product IDs 21490-17084
Original records & references
PUBLISHED 2026-09-30T21:16:35-04:00
MODIFIED 2026-10-05T21:16:33-04:00
INGESTED 2026-10-06T11:45:14-04:00