🛡️ MGASA-2026-0231 — opensc (CVE-2026-10275 +1 more)

Updated opensc packages fix security vulnerabilities

These packages fix security vulnerabilities:

CVE-2026-10275, A flaw has been found in OpenSC up to 0.26.1. This

affects the function test_kpgen_certwrite of the file

src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation

Module. This manipulation causes buffer overflow. The attack is possible

to be carried out remotely. The complexity of an attack is rather high.

It is indicated that the exploitability is difficult. The exploit has

been published and may be used. Patch name:

814f745b3b6d100295f65f1935edd33d520d33ab. It is recommended to apply a

patch to fix this issue.

CVE-2026-40528, OpenSC before 0.27.0, fixed in commit 0358817, contains

a stack and heap buffer overrun vulnerability in the do_key_value()

function in src/pkcs15init/profile.c that allows attackers to corrupt

memory by supplying a crafted profile configuration file. During

pkcs15-init invocation, a key value entry beginning with '=' followed by

more than sizeof(keybuf) characters is copied into keybuf via memcpy

without a length check, causing both stack and heap buffer overruns.