The vulnerability is a stack‑buffer‑overflow WRITE in the card‑oberthur module of OpenSC. When a token or smart‑card provides specially crafted APDU responses, the driver writes beyond the bounds of a local stack buffer, potentially corrupting the control flow of the application. The weakness is identified as CWE‑120 and CWE‑121, and the CVSS score of 3.8 indicates that an exploit would grant local privilege escalation or unilateral denial of service rather than remote compromise.

The affected product is the OpenSC open‑source smart‑card toolkit. Versions prior to 0.27.0 are vulnerable. The fix is available in OpenSC 0.27.0 and later, which removes the unchecked buffer copy that triggers the overflow.

The CVSS impact score of 3.8 combined with an EPSS below 1% and a non‑listing in the CISA KEV catalog suggests a low‑to‑moderate risk for environments that do not provide physical access to the target machine at the time of token usage. Exploitation requires an attacker to be physically near the computer and to provide a malicious USB device or smart card that interfaces with OpenSC. Organizations with strict physical controls may consider the risk lower, but the vulnerability would still be mitigated by applying the official patch to eliminate the overflow entirely.