OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780711381 advisory.

  - OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in     piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger     memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than     118 bytes in the Key History Object ASN.1 response. (CVE-2026-40510)

  - OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in     the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by     supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning     with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length     check, causing both stack and heap buffer overruns. (CVE-2026-40528)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781088266 advisory.

  - OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in     the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by     supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning     with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length     check, causing both stack and heap buffer overruns. (CVE-2026-40528)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781088266 advisory.

  - OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in     the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by     supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning     with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length     check, causing both stack and heap buffer overruns. (CVE-2026-40528)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of opensc installed on the remote host is prior to 0.19.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3824 advisory.

    OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in     the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by     supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning     with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length     check, causing both stack and heap buffer overruns. (CVE-2026-40528)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1988 advisory.

    OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in     the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by     supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning     with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length     check, causing both stack and heap buffer overruns. (CVE-2026-40528)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2697-1 advisory.

    This update for opensc fixes the following issues

    - CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).
    - CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).
    - CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior     (bsc#1261219).
    - CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).
    - CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation     (bsc#1267246).
    - CVE-2026-40528: stack and heap buffer overrun in the `do_key_value()` function due to missing length     check allows for       memory corruption via a crafted profile configuration file (bsc#1266963).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2657-1 advisory.

    This update for opensc fixes the following issues

    - CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214).
    - CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218).
    - CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior     (bsc#1261219).
    - CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220).
    - CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation     (bsc#1267246).
    - CVE-2026-40528: stack and heap buffer overrun in the `do_key_value()` function due to missing length     check allows for       memory corruption via a crafted profile configuration file (bsc#1266963).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in     the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by     supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning     with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length     check, causing both stack and heap buffer overruns. (CVE-2026-40528)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
360202	AlmaLinux 9.2 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780711381)	Nessus	Alma Linux Local Security Checks	Local	low
353147	Rocky Linux 9.6 [TuxCare] Security Update: opensc (ALMALINUX9.6:CLSA-2026:1781088266)	Nessus	Rocky Linux Local Security Checks	Local	low
352465	AlmaLinux 9.6 [TuxCare] Security Update: opensc (ALMALINUX9.6:CLSA-2026:1781088266)	Nessus	Alma Linux Local Security Checks	Local	low
328848	Amazon Linux 2 : opensc, --advisory ALAS2-2026-3824 (ALAS-2026-3824)	Nessus	Amazon Linux Local Security Checks	Local	low
328462	Amazon Linux 2023 : opensc (ALAS2023-2026-1988)	Nessus	Amazon Linux Local Security Checks	Local	low
324873	SUSE SLED15 / SLES15 Security Update : opensc (SUSE-SU-2026:2697-1)	Nessus	SuSE Local Security Checks	Local	low
323240	SUSE SLES15 Security Update : opensc (SUSE-SU-2026:2657-1)	Nessus	SuSE Local Security Checks	Local	low
321651	Linux Distros Unpatched Vulnerability : CVE-2026-40528	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-40528

low

Tenable Plugins

low

low

low

low

low

low

low

low