CVE-2025-49010: 
NixOS vulnerability analysis and mitigation

CVE-2025-49010 is a stack-based buffer overflow vulnerability in OpenSC's sc_get_response() function, triggered during processing of GET RESPONSE APDUs. It affects all versions of OpenSC prior to 0.27.0 (specifically 0.26.1 and earlier). The vulnerability was originally reported by OSS-Fuzz, disclosed on March 30, 2026, and patched in OpenSC 0.27.0. The CVSS v3.1 base score is 6.8 (Medium/High per NVD), though the OpenSC advisory assigns a lower score of 3.8 (Low) reflecting the high attack complexity and required physical access (GitHub Advisory, Red Hat).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-120 (Classic Buffer Overflow). The vulnerability exists because iso7816_get_response() and nqapplet_get_response() return early when a GET RESPONSE APDU contains zero-length data, without adjusting the count return parameter to reflect the actual data length — causing a write beyond the bounds of the caller-provided buffer in sc_get_response(). Exploitation requires a physically connected, specially crafted USB device or smart card that returns malicious APDU responses; no network-based attack vector exists. The fix was applied in commit 953986f65db61871bbbff72788d861d67d5140c6 and affects a broad range of card drivers including skeid, cardos, PIV-II, cac, openpgp, and many others (OpenSC Wiki, GitHub Advisory).

Successful exploitation could result in low-to-high impacts on confidentiality, integrity, and availability depending on the CVSS scoring source used. Because the vulnerable code resides in the libopensc library, the flaw is accessible through OpenSC tools, the PKCS#11 module, the Windows minidriver, and the Cryptographic Token Kit (CTK), broadening the potential attack surface across multiple application contexts. However, exploitation is constrained to scenarios where an attacker has physical access to the target computer at the moment a user or administrator is actively using a smart card or USB token, significantly limiting real-world impact (GitHub Advisory, OpenSC Wiki).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation. The vulnerability was originally discovered through automated fuzzing via OSS-Fuzz, not through adversarial research. The EPSS score is approximately 0.019% (0.000190), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity — requiring both physical access and a specially crafted hardware device — makes weaponization unlikely (GitHub Advisory, Feedly).

1. Prepare malicious hardware: Craft a USB smart card device or token that is programmed to return a 0-length data payload in response to GET RESPONSE APDU commands, deviating from the expected protocol behavior.
2. Gain physical access: Obtain physical access to the target computer at a time when a legitimate user or administrator is actively using a smart card or USB token with OpenSC (e.g., during authentication or certificate operations).
3. Insert malicious device: Connect the crafted USB device or smart card to the target system, causing OpenSC to interact with it via the affected card driver (any of the 30+ supported drivers including PIV-II, cac, openpgp, etc.).
4. Trigger the overflow: When OpenSC processes the GET RESPONSE APDU from the malicious device, iso7816_get_response() or nqapplet_get_response() returns early without updating the count parameter, causing sc_get_response() to write beyond the allocated stack buffer.
5. Achieve impact: Depending on memory layout and stack contents, the overflow may cause a crash (denial of service), corrupt adjacent stack data, or potentially enable code execution in the context of the process using the OpenSC library (OpenSC Wiki, GitHub Advisory).

• Process: Unexpected crashes or segmentation faults in processes using the OpenSC PKCS#11 module, minidriver, or CTK (e.g., pkcs11-tool, browser processes, VPN clients using smart card authentication).
• Logs: System logs (e.g., /var/log/syslog, Windows Event Log) showing application crashes or access violations originating from libopensc during smart card operations.
• Hardware: Presence of an unrecognized or unauthorized USB smart card device connected to the system at the time of a crash event.
• File System: Core dump files generated by OpenSC-linked processes following unexpected termination during APDU processing.

The primary remediation is to upgrade OpenSC to version 0.27.0 or later, which contains the fix in commit 953986f65db61871bbbff72788d861d67d5140c6. No official workaround is available for systems that cannot be immediately upgraded. As a compensating control, organizations should enforce strict physical security policies to prevent unauthorized USB devices or smart cards from being connected to systems running OpenSC, and ensure only trusted, verified hardware tokens are used. Linux distributions including openSUSE and Fedora have issued updated packages incorporating the fix (GitHub Advisory, OpenSC Wiki).

Red Hat acknowledged the vulnerability and published a security advisory tracking it against their products. Microsoft also referenced the CVE in their Security Response Center update guide, indicating relevance to Azure Linux packages (azl3_opensc). The German security news site Pro-Linux published multiple coverage articles as downstream distributions released patches. No significant social media discussion or notable researcher commentary beyond the official disclosure has been observed, consistent with the low severity and constrained exploitation requirements of this vulnerability (Red Hat, Microsoft MSRC).