CVE-2026-103531

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103531", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-30T19:06:48.961Z", "datePublished": "2026-10-01T00:45:15.812Z", "dateUpdated": "2026-10-05T23:57:51.416Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-01T00:45:15.812Z"}, "title": "OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "OpenSC", "versions": [{"version": "0.27.0", "status": "affected"}, {"version": "0.27.1", "status": "affected"}], "cpes": ["cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-setcos.c. Executing a manipulation of the argument type_attr can lead to stack-based buffer overflow. The attack can be launched remotely. This patch is called ad730304052937c32b4eb489a06835ac6123632c. It is best practice to apply a patch to resolve this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-30T21:11:57.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "zzxzzb (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/412343", "name": "VDB-412343 | OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/412343/cti", "name": "VDB-412343 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103531", "name": "CVE-2026-103531 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/956910", "name": "Submit #956910 | OpenSC >= 0.12.2 up to and including 0.27.1 (latest release, unfixed; fix approved in PR #3812, pending merge) Buffer Overflow (stack, CWE-121)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenSC/OpenSC/pull/3812", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c", "tags": ["patch"]}, {"url": "https://github.com/OpenSC/OpenSC/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-05T23:57:41.325085Z", "id": "CVE-2026-103531", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T23:57:51.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103531", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T23:57:41.325085Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-05T23:57:46.585Z"}}], "cna": {"tags": ["x_open-source"], "title": "OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "zzxzzb (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:*"], "vendor": "n/a", "product": "OpenSC", "versions": [{"status": "affected", "version": "0.27.0"}, {"status": "affected", "version": "0.27.1"}]}], "timeline": [{"lang": "en", "time": "2026-09-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-30T21:11:57.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/412343", "name": "VDB-412343 | OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/412343/cti", "name": "VDB-412343 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103531", "name": "CVE-2026-103531 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/956910", "name": "Submit #956910 | OpenSC >= 0.12.2 up to and including 0.27.1 (latest release, unfixed; fix approved in PR #3812, pending merge) Buffer Overflow (stack, CWE-121)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenSC/OpenSC/pull/3812", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c", "tags": ["patch"]}, {"url": "https://github.com/OpenSC/OpenSC/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-setcos.c. Executing a manipulation of the argument type_attr can lead to stack-based buffer overflow. The attack can be launched remotely. This patch is called ad730304052937c32b4eb489a06835ac6123632c. It is best practice to apply a patch to resolve this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-01T00:45:15.812Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103531", "state": "PUBLISHED", "dateUpdated": "2026-10-05T23:57:51.416Z", "dateReserved": "2026-09-30T19:06:48.961Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-01T00:45:15.812Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:opensc:opensc:*:*:*:*:*:*:*:*"], "product": "OpenSC", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.27.0"}, {"status": "affected", "version": "0.27.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-setcos.c. Executing a manipulation of the argument type_attr can lead to stack-based buffer overflow. The attack can be launched remotely. This patch is called ad730304052937c32b4eb489a06835ac6123632c. It is best practice to apply a patch to resolve this issue."}], "id": "CVE-2026-103531", "lastModified": "2026-10-06T01:16:33.190", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103531", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-05T23:57:41.325085Z", "version": "2.0.3"}}]}, "published": "2026-10-01T01:16:35.963", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/OpenSC/OpenSC/"}, {"source": "cna@vuldb.com", "url": "https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c"}, {"source": "cna@vuldb.com", "url": "https://github.com/OpenSC/OpenSC/pull/3812"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-103531"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/956910"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/412343"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/412343/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-121"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "opensc: opensc: Arbitrary code execution via stack-based buffer overflow in card-setcos", "id": "2544409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544409"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in OpenSC. A stack-based buffer overflow vulnerability exists in the SetCOS smart card driver during the handling of file control information in the setcos_construct_fci_44 function. By supplying manipulated card attributes, an attacker could trigger memory corruption, potentially leading to arbitrary code execution or an application crash resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103531", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "opensc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "opensc", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "opensc", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "opensc", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-01T00:45:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103531\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103531\nhttps://github.com/OpenSC/OpenSC/\nhttps://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c\nhttps://github.com/OpenSC/OpenSC/pull/3812\nhttps://vuldb.com/cve/CVE-2026-103531\nhttps://vuldb.com/submit/956910\nhttps://vuldb.com/vuln/412343\nhttps://vuldb.com/vuln/412343/cti"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.27.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.27.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSC", "source": "cna", "vendor": "n/a"}, "product": "opensc", "vendor": "opensc"}], "created": "2026-10-01T02:30:18.226117+00:00", "updated": "2026-10-02T02:30:18.250680+00:00", "vendors": ["opensc", "opensc$PRODUCT$opensc"]}