The vulnerability resides in the setcos_construct_fci_44 function of OpenSC's card-setcos.c module. Manipulating the type_attr argument triggers a stack-based buffer overflow, as noted in the CVE description. This flaw corresponds to the classic stack buffer overflow weaknesses outlined by CWE-119 and CWE-121. No explicit claim of arbitrary code execution is recorded in the description; the impact is the possibility of a stack overflow when the function processes malformed input.

All installations of OpenSC version 0.27.1 or earlier are affected, as specified by the CNA vendor list and the cpe string. The CVE references the OpenSC library and indicates the vulnerability applies to the card-setcos.c component. No additional sub‑product or platform details are provided.

The CVSS base score is 5.1, implying moderate severity. The CVE states the attack can be launched remotely, so an attacker from outside the host can exploit the flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. Even though exploitation potential has not been proven, systems exposed to remote smart card interfaces that run this library remain at risk if the patch has not been applied.