CVE-2026-103531: Stack-based Buffer Overflow in OpenSC
CVE-2026-103531 is a stack-based buffer overflow vulnerability in OpenSC versions 0.27.0 and 0.27.1. The flaw exists in the function setcos_construct_fci_44 within the src/libopensc/card-setcos.c file. An attacker can remotely trigger this vulnerability by manipulating the argument type_attr, potentially causing a buffer overflow on the stack. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity. A patch identified by commit ad730304052937c32b4eb489a06835ac6123632c is available to fix this issue. It is recommended to apply this patch to mitigate the vulnerability.
AI Analysis
Technical Summary
OpenSC versions 0.27.0 and 0.27.1 contain a stack-based buffer overflow vulnerability in the setcos_construct_fci_44 function of src/libopensc/card-setcos.c. The vulnerability arises when the argument type_attr is manipulated, leading to a stack overflow condition. This flaw can be exploited remotely. A patch has been released (commit ad730304052937c32b4eb489a06835ac6123632c) to address this issue.
Potential Impact
Successful exploitation of this vulnerability could lead to a stack-based buffer overflow, which may allow an attacker to cause a denial of service or potentially execute arbitrary code with limited privileges. The vulnerability is remotely exploitable, increasing its risk profile. However, the CVSS score of 5.1 indicates a medium severity level, suggesting some limitations in exploitability or impact.
Mitigation Recommendations
A patch identified by commit ad730304052937c32b4eb489a06835ac6123632c is available to fix this vulnerability. It is recommended to apply this patch to OpenSC versions 0.27.0 and 0.27.1 to remediate the issue. No vendor advisory content was provided to indicate otherwise, so patching is the advised mitigation.
CVE-2026-103531: Stack-based Buffer Overflow in OpenSC
Description
CVE-2026-103531 is a stack-based buffer overflow vulnerability in OpenSC versions 0.27.0 and 0.27.1. The flaw exists in the function setcos_construct_fci_44 within the src/libopensc/card-setcos.c file. An attacker can remotely trigger this vulnerability by manipulating the argument type_attr, potentially causing a buffer overflow on the stack. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity. A patch identified by commit ad730304052937c32b4eb489a06835ac6123632c is available to fix this issue. It is recommended to apply this patch to mitigate the vulnerability.
CVSS v4.0
Score 5.1medium
Affected software
OpenSC
cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenSC versions 0.27.0 and 0.27.1 contain a stack-based buffer overflow vulnerability in the setcos_construct_fci_44 function of src/libopensc/card-setcos.c. The vulnerability arises when the argument type_attr is manipulated, leading to a stack overflow condition. This flaw can be exploited remotely. A patch has been released (commit ad730304052937c32b4eb489a06835ac6123632c) to address this issue.
Potential Impact
Successful exploitation of this vulnerability could lead to a stack-based buffer overflow, which may allow an attacker to cause a denial of service or potentially execute arbitrary code with limited privileges. The vulnerability is remotely exploitable, increasing its risk profile. However, the CVSS score of 5.1 indicates a medium severity level, suggesting some limitations in exploitability or impact.
Mitigation Recommendations
A patch identified by commit ad730304052937c32b4eb489a06835ac6123632c is available to fix this vulnerability. It is recommended to apply this patch to OpenSC versions 0.27.0 and 0.27.1 to remediate the issue. No vendor advisory content was provided to indicate otherwise, so patching is the advised mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-30T19:06:48.961Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abdb4fb2a4e24523dfdeb6f
Added to database: 10/01/2026, 01:18:51 UTC
Last enriched: 10/01/2026, 01:32:54 UTC
Last updated: 10/01/2026, 04:55:49 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.