Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
opensc may crash with malicious smart card
published 1 month ago
Summary
The opensc software on SUSE systems can be tricked by a specially crafted smart card or USB device to corrupt its memory, which could cause the program to crash or behave unexpectedly. This risk affects any system using opensc to read PIV smart cards. Install the latest opensc update as soon as possible to fix the issue.
What to do
- Update suse opensc to version 0.26.1-160000.4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 16.0 | suse | opensc |
< 0.26.1-160000.4.1 Fix: upgrade to 0.26.1-160000.4.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | opensc |
< 0.26.1-160000.4.1 Fix: upgrade to 0.26.1-160000.4.1
|
Original advisory text
Security update for opensc
This update for opensc fixes the following issue:
- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory
corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).
- CVE-2026-40510: stack buffer overflow in `piv_process_history()` allows physically present attackers to trigger memory
corruption by presenting a crafted PIV smart card or USB device (bsc#1266964).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-202623697-1/ Vendor Advisory
- https://bugzilla.suse.com/1266964 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-40510 URL
Timeline
Published9 Sep 2026
Updated29 Sep 2026
First seen29 Sep 2026
Sources
SUSE-SU-2026:23697-1 · OSV
Track software like this
Free during beta