CVE-2026-40510

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0-rc1

Description A stack buffer overflow exists in the piv process history() function within src/libopensc/card-piv.c. This issue allows a physically present attacker to cause memory corruption by using a specially crafted PIV smart card or USB device. The trigger occurs when the device returns a URL field exceeding 118 bytes in the Key History Object ASN.1 response.

Recommendations Update to version 0.27.0-rc1 or apply the fix from commit 3f24f0b.