CVE-2026-40510: Opensc Project Opensc

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.

Affected products

• Opensc Project Opensc: before 0.27.0 (fixed in 0.27.0)

Published 2026-05-29. Last modified 2026-07-21.