VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 18, 2022· Updated Nov 3, 2025

CVE-2021-42782

CVE-2021-42782

Description

Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Stack buffer overflow vulnerabilities in OpenSC before 0.22.0 could crash programs using the library.

Vulnerability

Stack buffer overflow vulnerabilities exist in multiple places in OpenSC versions before 0.22.0. These occur in the PIV driver (improper ASN1 tag validation) [1], the TCOS driver (out-of-bounds read) [3], and the CardOS driver (incorrect buffer length calculation) [4]. The issues can be triggered when processing specially crafted smart card responses or data structures.

Exploitation

An attacker with physical access to a smart card or the ability to manipulate communication between the card and reader can supply maliciously crafted ASN1 data or TLV structures. No authentication is required, but the victim must use a vulnerable application that relies on OpenSC to read the card. The attacker can induce a stack buffer overflow by providing oversized or improperly formatted input.

Impact

Successful exploitation can cause a denial of service (crash) in applications using the OpenSC library. The description notes that the overflow "could potentially crash programs." While arbitrary code execution is not explicitly stated, stack buffer overflows may lead to code execution in some contexts [2].

Mitigation

Update to OpenSC version 0.22.0 or later, which contains the fixes for all identified issues [1][3][4]. No known workarounds are available. Users should patch as soon as possible.

References
  1. PIV Improved parsing of data from the card · OpenSC/OpenSC@456ac56
  2. Stack buffer overflow issues in various places
  3. tcos: prevent out of bounds read · OpenSC/OpenSC@78cdab9
  4. cardos: Correctly calculate the left bytes to avoid buffer overrun · OpenSC/OpenSC@1252aca

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

32

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.