The vulnerability is a stack buffer overflow (CWE‑120) in the piv_process_history() function of src/libopensc/card-piv.c in OpenSC prior to version 0.27.0‑rc1. A crafted PIV smart card or USB device can return a URL field longer than 118 bytes in the Key History Object ASN.1 response, causing overflow and memory corruption. This can lead to arbitrary code execution or disruption of the hosting process when the affected code is exercised.

Any installation of OpenSC before version 0.27.0‑rc1 is affected. The vendor, OpenSC, provides the product OpenSC. No specific sub‑products are listed beyond the core library; therefore, all derived tools that invoke the vulnerable function are potentially impacted. Versions later than 0.27.0‑rc1 are not vulnerable.

The CVSS score is 1.0 and the EPSS score is < 1%, indicating low severity and a low likelihood of exploitation under current data. The issue requires physical proximity to the card or USB device, so the attack vector is local. Investigation of the commit history shows that the flaw has been patched without any reported active exploitation. Since the vulnerability appears in an environment that may be isolated, the overall risk to public‑facing services is low, but local attackers or those with physical access to the system can trigger memory corruption.