The vulnerability resides in the sc_compacttlv_find_tag function used by OpenSC before version 0.27.0. The function incorrectly interprets a compact‑TLV element’s length field without verifying that the claimed length fits within the remaining buffer. When supplied with untrusted data, this flaw can produce a pointer that references beyond the legitimate buffer limits and an out‑of‑bounds length value, potentially leading to memory corruption during later access. The weakness is classified as CWE‑126 (Buffer Over-read) and CWE‑805 (Buffer Access with Incorrect Length Value).

OpenSC, Version 0.27.0 and earlier are affected. The issue was fixed in OpenSC 0.27.0; no older product versions are listed in the CNA data.

The CVSS score is 3.9, indicating low to moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via untrusted input, such as data read from smart cards or files manipulated by attackers. Exploitability requires the attacker to supply a crafted compact‑TLV buffer, which can be achieved when the smart card backend accepts arbitrary input.