CVE-2025-13763 (GCVE-0-2025-13763)
Vulnerability from cvelistv5 – Published: 2026-04-23 12:27 – Updated: 2026-04-23 14:05
VLAI?
Title
Libopensc: opensc: multiple uses of uninitialized variable
Summary
Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs
Severity ?
5.7 (Medium)
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OpenSC | OpenSC |
Affected:
0 , < 0.27.0
(semver)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Date Public ?
2026-04-23 12:09
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13763",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-23T14:04:28.240123Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T14:05:23.182Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSC",
"vendor": "OpenSC",
"versions": [
{
"lessThan": "0.27.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "opensc",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "opensc",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "opensc",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "opensc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-23T12:09:46.867Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs"
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Low"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T12:33:39.857Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-13763"
},
{
"name": "RHBZ#2417581",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2417581"
},
{
"url": "https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv"
},
{
"url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-27T14:28:07.219Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-23T12:09:46.867Z",
"value": "Made public."
}
],
"title": "Libopensc: opensc: multiple uses of uninitialized variable",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, avoid connecting untrusted USB devices or smart cards to systems running affected versions of Red Hat Enterprise Linux. This operational control reduces the risk of an attacker presenting a specially crafted device to exploit the uninitialized variable flaws in `libopensc`."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2025-13763",
"datePublished": "2026-04-23T12:27:41.820Z",
"dateReserved": "2025-11-27T14:35:05.731Z",
"dateUpdated": "2026-04-23T14:05:23.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-13763",
"date": "2026-04-25",
"epss": "0.00018",
"percentile": "0.04876"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-13763\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-04-23T13:16:09.697\",\"lastModified\":\"2026-04-24T14:50:56.203\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.5,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-457\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-13763\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2417581\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Libopensc: opensc: multiple uses of uninitialized variable\", \"metrics\": [{\"other\": {\"content\": {\"value\": \"Low\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}, \"type\": \"Red Hat severity rating\"}}, {\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"PHYSICAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 5.7, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs\"}], \"affected\": [{\"vendor\": \"OpenSC\", \"product\": \"OpenSC\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.27.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"opensc\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"opensc\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"opensc\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"opensc\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"]}], \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2025-13763\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2417581\", \"name\": \"RHBZ#2417581\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv\"}, {\"url\": \"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763\"}], \"datePublic\": \"2026-04-23T12:09:46.867Z\", \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, avoid connecting untrusted USB devices or smart cards to systems running affected versions of Red Hat Enterprise Linux. This operational control reduces the risk of an attacker presenting a specially crafted device to exploit the uninitialized variable flaws in `libopensc`.\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-11-27T14:28:07.219Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-23T12:09:46.867Z\", \"value\": \"Made public.\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-04-23T12:33:39.857Z\"}, \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-13763\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-23T14:04:28.240123Z\"}}}], \"references\": [{\"url\": \"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv\", \"tags\": [\"exploit\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-457\", \"description\": \"CWE-457 Use of Uninitialized Variable\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-23T14:05:19.606Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2025-13763\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"redhat\", \"dateReserved\": \"2025-11-27T14:35:05.731Z\", \"datePublished\": \"2026-04-23T12:27:41.820Z\", \"dateUpdated\": \"2026-04-23T14:05:23.182Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…