CVE-2018-16426

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.19.0-rc1

Description The issue arises from endless recursion when handling responses from an IAS-ECC card in the iasecc select file function in libopensc/card-iasecc.c. This could be exploited by attackers who can supply crafted smartcards, potentially causing the opensc library to hang or crash when used by programs.

Recommendations For versions prior to 0.19.0-rc1, update to version 0.19.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted smartcards to minimize the risk of exploitation.