OpenSC contains a stack‑buffer‑overflow write vulnerability in the card‑oberthur module that can be triggered by specially crafted responses from a USB device or smart card. This flaw, identified as CWE‑121, allows an attacker to corrupt the stack and potentially change program behaviour or cause a crash, compromising the integrity or availability of the middleware.

All versions of OpenSC prior to 0.27.0 are affected. The problem exists on any system running OpenSC that accepts smart card or USB token input, including typical Windows, Linux, and macOS environments, and requires an attacker with physical access to the computer when a user or administrator operates a token.

The CVSS score of 3.8 reflects moderate severity. No EPSS score is available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires physical access to the target machine and the ability to supply a crafted device, making the attack vector local and dependent on a user or administrator interacting with a token. In practice, the risk is limited to environments where tokens are used at possibly unsecured workstations.