A stack‑buffer‑overflow occurs in the GET RESPONSE routine of OpenSC, the open‑source smart card middleware. The overflow is triggered when a crafted response to an APDU is received. An attacker with physical access to the computer can exploit this by presenting a specially crafted USB device or smart card. The overflow overwrites stack data, potentially corrupting program execution or leading to denial of service. The weakness corresponds to common buffer‑overflow flaws (CWE‑120 and CWE‑121).

The issue affects all installations of OpenSC prior to version 0.27.0. Users of OpenSC running on any operating system that utilizes smart card readers are vulnerable. The vulnerability is resolved in OpenSC 0.27.0 and later releases.

The CVSS score 3.8 indicates low to moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires physical access to the target machine and the presence of a malicious USB device or smart card, raising the barrier to attack. Consequently, while the flaw could allow an attacker to corrupt memory and potentially elevate privileges within a local user session, the overall risk to most deployments remains modest. However, mitigation is recommended to avoid any local compromise that could be leveraged by advanced threat actors.