Raw vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2025-66038 is a low-severity Buffer Over-read (CWE-126) vulnerability in Opensc Project Opensc. Its CVSS base score is 3.9 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209127
Vulnerability Data
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, sc_compacttlv_find_tag searches a compact-TLV buffer for a given tag. In compact-TLV, a single byte encodes the tag (high nibble) and value length (low nibble). With a…
more
1-byte buffer {0x0A}, the encoded element claims tag=0 and length=10 but no value bytes follow. Calling sc_compacttlv_find_tag with search tag 0x00 returns a pointer equal to buf+1 and outlen=10 without verifying that the claimed value length fits within the remaining buffer. In cases where the sc_compacttlv_find_tag is provided untrusted data (such as being read from cards/files), attackers may be able to influence it to return out-of-bounds pointers leading to downstream memory corruption when subsequent code tries to dereference the pointer. This issue has been patched in version 0.27.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, bounds checking tests) directly finds buffer over-read flaws.
Engineering principles such as memory-safe design and bounds-checked abstractions structurally stop introduction of out-of-bounds reads.
Process isolation limits the blast radius of an over-read to the compromised domain.
Input validation enforces length and index constraints that prevent many externally triggered over-reads.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly prevent introduction of buffer over-read weaknesses.
Vulnerability identification processes can discover buffer over-read flaws via scanning or review.
Patching or replacing vulnerable software removes known instances of buffer over-read bugs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect buffer over-reads before release.
Secure SDLC mandates input validation and bounds checking that can prevent buffer over-reads.
Application security requirements can specify buffer-size and bounds-checking rules.
Secure architecture principles include memory-safety and bounds-checking design choices.
Secure coding standards directly require bounds-checked buffer access, mitigating over-reads.