OpenSC, a widely used library for smart card interactions, contains an out‑of‑bounds heap read in its PKCS#15 reader. The flaw arises when the function that reads an X.509/SPKI field allocates a zero‑length buffer and then reads one byte beyond it. When an attacker supplies a crafted input to the fuzz_pkcs15_reader harness, the program may leak data from memory, leading to potential disclosure of sensitive information. This vulnerability is a classic buffer overread, classified as CWE‑125.

The affected vendor is the OpenSC project, offering the OpenSC smart‑card middleware and utilities. All versions prior to 0.27.0 are susceptible; the patch was delivered in release 0.27.0. Systems running an older build of the OpenSC libraries or tools that invoke the fuzz_pkcs15_reader component are at risk.

CVSS base score of 3.9 indicates low severity, and the EPSS score, below 1 %, suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, further implying limited known exploitation. Exploitation requires supplying a deliberate input to a specific harness function, likely in a controlled environment or testing framework. Because the overread is confined to an internal buffer and does not trigger a crash or remote code execution, the immediate risk to operational systems is modest. Nonetheless, any untrusted data fed into the PKCS#15 reader should be considered a potential attack vector.