A flaw has been found in OpenSC up to 0

CVE-2026-10275 is a buffer overflow in OpenSC's pkcs11-tool, specifically the test_kpgen_certwrite() path used during key-generation testing. The vulnerable code copies a token-returned CKA_ID into a fixed 100-byte global buffer without a length check. Public reporting pegs affected versions at OpenSC 0.26.1 and earlier, and the trigger path is tied to pkcs11-tool test flows such as --test-kpgen, --test-ec, or similar key-generation operations rather than normal passive library loading.

The vendor-style MEDIUM baseline is too generous for enterprise patch priority because the real attack path is *not* unauthenticated network exposure. The attacker needs a victim to run a niche admin/testing utility against a malicious PKCS#11 module or hostile smart card/token, which means post-delivery social engineering, lab/admin interaction, or supply-chain tampering. That's real risk, but it is workstation-local, operator-dependent, and has a tiny exposed population compared with the CVSS vector's AV:N framing.

Why this verdict

• Attacker position is much worse than CVSS suggests: the public report itself describes the vector as Local / Physical, because the victim must load a malicious PKCS#11 module or interact with a hostile token.
• The vulnerable code path is niche: exploitation requires the pkcs11-tool key-generation test flow, which sharply limits exposed hosts to smart-card admins, developers, and provisioning workflows.
• Reachable population is tiny: OpenSC is not a public-facing daemon, so this is not a scan-and-own internet problem across 10,000 hosts.
• No exploitation signal: no KEV listing, no in-the-wild reporting found, and the EPSS is extremely low.
• Blast radius is local and bounded: even if exploited, the expected impact is a local admin workstation process, not a server-side fleet-wide compromise.

Why not higher?

A higher rating would require broad, low-friction reachability or strong evidence that attackers are already using it. We have neither: this is not externally exposed, requires user/admin action, and sits behind a very specific operational workflow. The memory-corruption primitive matters technically, but severity in enterprise patching is driven by *how many systems can realistically be hit*, not just what happens in a debugger.

Why not lower?

It is still a real out-of-bounds write in security tooling, with a public reproducer and a vendor fix commit. Environments that provision tokens, test PKCS#11 modules, or ingest third-party smart-card middleware do have a plausible path to host compromise on admin systems. That keeps it above IGNORE.

1. Restrict PKCS#11 module loading — Allow only approved module paths, signed vendor middleware, and managed package sources for OpenSC tooling. This directly cuts off the easiest abuse path described in the public issue; for a LOW verdict there is no SLA, so treat it as backlog hygiene and fold it into your normal endpoint-hardening cycle.
2. Fence smart-card admin workflows — Run pkcs11-tool provisioning and troubleshooting only on dedicated admin workstations or disposable lab VMs, not general-purpose user endpoints. That contains the blast radius to a small, monitored population; for LOW, treat this as backlog hygiene rather than emergency action.
3. Monitor smart-card tooling execution — Create detections for pkcs11-tool with --module, key-generation test flags, unexpected library paths, and crash signatures. This will not prevent the bug, but it gives you visibility into the exact high-friction workflow required for exploitation; again, LOW means no formal SLA.
4. Prefer packaged or backported fixes — Where OpenSC is centrally managed, consume the vendor/distro package once a release or backport carrying the fix is available, or backport commit 814f745 in controlled builds if you own the package pipeline. Because this is LOW, handle it through regular maintenance rather than disruption-driven change windows.

Run this on the target host or gold image where OpenSC is installed. Invoke it with python3 check_opensc_cve_2026_10275.py as a standard user; no admin rights are needed unless your package manager hides version data. The script tries pkcs11-tool --version first and falls back to common package managers, then prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_opensc_cve_2026_10275.py
# Determine likely exposure to CVE-2026-10275 based on installed OpenSC version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import shutil
import subprocess
from typing import Optional, Tuple


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        return p.returncode, p.stdout.strip()
    except Exception:
        return 999, ""


def parse_version(text: str) -> Optional[Tuple[int, ...]]:
    # Match versions like 0.26.1 or 0.27.0
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def get_version_from_pkcs11_tool() -> Optional[Tuple[int, ...]]:
    exe = shutil.which('pkcs11-tool')
    if not exe:
        return None
    for args in ([exe, '--version'], [exe, '-V']):
        rc, out = run(args)
        v = parse_version(out)
        if v:
            return v
    return None


def get_version_from_linux_pkg() -> Optional[Tuple[int, ...]]:
    checks = [
        ['dpkg-query', '-W', '-f=${Version}', 'opensc'],
        ['rpm', '-q', 'opensc'],
        ['dnf', 'info', 'opensc'],
        ['apt-cache', 'policy', 'opensc'],
        ['pacman', '-Qi', 'opensc'],
        ['zypper', 'info', 'opensc'],
    ]
    for cmd in checks:
        if not shutil.which(cmd[0]):
            continue
        rc, out = run(cmd)
        v = parse_version(out)
        if v:
            return v
    return None


def get_version_from_macos_pkg() -> Optional[Tuple[int, ...]]:
    checks = [
        ['brew', 'list', '--versions', 'opensc'],
        ['port', 'installed', 'opensc'],
        ['pkgutil', '--pkgs'],
    ]
    for cmd in checks:
        if not shutil.which(cmd[0]):
            continue
        rc, out = run(cmd)
        if cmd[0] == 'pkgutil' and 'org.opensc' not in out.lower():
            continue
        v = parse_version(out)
        if v:
            return v
    return None


def get_version_from_windows() -> Optional[Tuple[int, ...]]:
    # Try pkcs11-tool first via PATH
    v = get_version_from_pkcs11_tool()
    if v:
        return v

    # Common install paths
    candidates = [
        r'C:\Program Files\OpenSC Project\OpenSC\tools\pkcs11-tool.exe',
        r'C:\Program Files (x86)\OpenSC Project\OpenSC\tools\pkcs11-tool.exe',
    ]
    for exe in candidates:
        if os.path.exists(exe):
            for args in ([exe, '--version'], [exe, '-V']):
                rc, out = run(args)
                v = parse_version(out)
                if v:
                    return v
    return None


def get_installed_version() -> Optional[Tuple[int, ...]]:
    v = get_version_from_pkcs11_tool()
    if v:
        return v

    if sys.platform.startswith('linux'):
        return get_version_from_linux_pkg()
    if sys.platform == 'darwin':
        return get_version_from_macos_pkg()
    if os.name == 'nt':
        return get_version_from_windows()
    return None


def main():
    v = get_installed_version()
    if not v:
        print('UNKNOWN - OpenSC version not detected')
        sys.exit(2)

    # Based on currently available public reporting, 0.26.1 and earlier are affected.
    # If your distro backports the fix without changing the version, manually verify changelog/patch metadata.
    affected_max = (0, 26, 1)
    fixed_min = (0, 27, 0)

    if v <= affected_max:
        print(f'VULNERABLE - detected OpenSC {version_to_str(v)} (publicly reported affected range is <= 0.26.1)')
        sys.exit(1)
    elif v >= fixed_min:
        print(f'PATCHED - detected OpenSC {version_to_str(v)} (outside publicly reported affected range)')
        sys.exit(0)
    else:
        print(f'UNKNOWN - detected OpenSC {version_to_str(v)}; unable to map confidently')
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. OpenSC fix commit 814f745
2. OpenSC issue #3682 public report
3. OpenSC releases
4. OpenSC wiki: Using pkcs11-tool and OpenSSL
5. OpenSC wiki: Overview
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. NVD CVE-2026-10275