CVE-2026-10275: OpenSC Buffer Overflow Vulnerability

CVE-2026-10275 Overview

CVE-2026-10275 is a buffer overflow vulnerability in OpenSC versions up to and including 0.26.1. The flaw resides in the test_kpgen_certwrite function within src/tools/pkcs11-tool.c, which is part of the pkcs11-tool Key Generation Module. Improper bounds checking on a URI-supplied object identifier allows a longer-than-expected value to be copied into a fixed-size buffer, triggering memory corruption [CWE-119].

The vulnerability is classified under the Common Weakness Enumeration as an Improper Restriction of Operations within the Bounds of a Memory Buffer. Exploitation requires user interaction and has high attack complexity. A patch is available under commit 814f745b3b6d100295f65f1935edd33d520d33ab.

Critical Impact
An attacker who supplies a crafted PKCS#11 URI can overflow a stack buffer in pkcs11-tool, leading to potential memory corruption and limited impact on confidentiality, integrity, and availability.

Affected Products

OpenSC up to and including version 0.26.1
pkcs11-tool utility within OpenSC
src/tools/pkcs11-tool.c Key Generation Module

Discovery Timeline

2026-06-01 - CVE-2026-10275 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10275

Vulnerability Analysis

The vulnerability exists in OpenSC's pkcs11-tool, a command-line utility for interacting with PKCS#11 modules used for smart card and hardware token operations. The defect lies in the test_kpgen_certwrite function, which handles key pair generation and certificate write testing.

When the tool processes a PKCS#11 URI containing an object identifier (id field), it copies the identifier into a fixed-size buffer named opt_object_id without first verifying that the source length fits the destination. An attacker-controlled id_len value larger than sizeof(opt_object_id) results in a buffer overflow on the stack.

Root Cause

The root cause is a missing length check before a memcpy operation. The code copies opt_uri->id_len bytes into the static opt_object_id buffer without validating the source length. This violates safe boundary handling for PKCS#11 URI parsing.

Attack Vector

Exploitation requires the victim to invoke pkcs11-tool with a maliciously crafted PKCS#11 URI. Because user interaction is required and exploitation complexity is high, real-world abuse is constrained. The exploit has been published publicly, increasing the likelihood of opportunistic attempts.

// Patch from src/tools/pkcs11-tool.c
// Adds length validation before memcpy to prevent buffer overflow
		}
		if (opt_uri->id) {
			opt_object_id_len = opt_uri->id_len;
+			if (opt_object_id_len > sizeof(opt_object_id))
+				util_fatal("URI's object ID too long");
			memcpy(opt_object_id, opt_uri->id, opt_object_id_len);
		}
	}

Source: GitHub Commit 814f745b

Detection Methods for CVE-2026-10275

Indicators of Compromise

Unexpected crashes or segmentation faults in pkcs11-tool processes recorded in system logs or core dumps.
Execution of pkcs11-tool with --slot or --object arguments referencing PKCS#11 URIs containing abnormally long id= parameters.
Presence of OpenSC builds at or below version 0.26.1 on endpoints that handle smart card or HSM workflows.

Detection Strategies

Inventory installed OpenSC packages across Linux, macOS, and Windows hosts and flag versions ≤ 0.26.1.
Audit command-line telemetry for pkcs11-tool invocations with PKCS#11 URI strings exceeding expected id field lengths.
Correlate process crash events for pkcs11-tool with the user account and parent process that launched it.

Monitoring Recommendations

Enable core dump collection and crash reporting for cryptographic tooling on workstations that interact with smart cards.
Monitor execution of pkcs11-tool from non-interactive contexts such as scripts, scheduled tasks, or service accounts.
Track package management events that install or update OpenSC and confirm patched versions are deployed.

How to Mitigate CVE-2026-10275

Immediate Actions Required

Upgrade OpenSC to a version that includes commit 814f745b3b6d100295f65f1935edd33d520d33ab once it is released downstream.
Restrict access to pkcs11-tool so that only trusted administrators and service accounts can execute it.
Avoid passing untrusted PKCS#11 URIs to pkcs11-tool from scripts, automation, or user-provided input.

Patch Information

The OpenSC maintainers published the fix as commit 814f745b3b6d100295f65f1935edd33d520d33ab. The patch adds an explicit length check using util_fatal to abort execution when an object identifier in a PKCS#11 URI exceeds sizeof(opt_object_id). See the OpenSC pull request #3684 and issue #3682 for additional context.

Workarounds

Disable or remove pkcs11-tool on systems that do not require PKCS#11 administration.
Sanitize or reject PKCS#11 URIs that contain id= values exceeding the documented maximum length before passing them to OpenSC utilities.
Apply the upstream patch manually by rebuilding OpenSC from source if a packaged update is not yet available.

bash

# Verify installed OpenSC version and check for the patched commit
pkcs11-tool --version

# Example: rebuild from source with the upstream fix applied
git clone https://github.com/OpenSC/OpenSC.git
cd OpenSC
git cherry-pick 814f745b3b6d100295f65f1935edd33d520d33ab
./bootstrap && ./configure && make && sudo make install