OpenSC versions prior to 0.27.0 contain a stack and heap buffer overrun in the do_key_value() function located in src/pkcs15init/profile.c. The vulnerability is triggered when a key value entry that begins with '=' and contains more characters than the internal key buffer size is supplied to pkcs15-init. The code copies this entry into a fixed‑size buffer using memcpy without checking the length, allowing an attacker to corrupt adjacent memory and potentially gain arbitrary code execution or cause a crash.

The affected product is OpenSC released by the OpenSC vendor, for all versions earlier than 0.27.0. No other vendors or product variations are listed.

The CVSS score is 1, indicating low severity, and the EPSS score is not available, suggesting a small exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to provide a crafted profile configuration file that is read by pkcs15‑init, implying a local or privileged user context rather than remote exploitation. If the attacker obtains write access to a profile file, memory corruption can occur, leading to possible arbitrary code execution or denial of service.