Critical UNKNOWN READ Vulnerability in OpenSC Package
Summary
OSV-2026-860: UNKNOWN READ in write_publickey. Affects opensc versions >= afbc8632eae65bfd912293b5c7075e40ca9588f5, < 39e8771238adf2e3ea0c3b23285b6825a8feaceb. Fixed in 39e8771238adf2e3ea0c3b23285b6825a8feaceb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSC is an open-source project that provides a set of libraries and utilities for working with smart cards and other cryptographic tokens. It enables secure access to various applications and services by managing cryptographic keys and performing secure transactions. However, like any software, OpenSC is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as OSV-2026-860 is characterized by an UNKNOWN READ error occurring in the 'write_publickey' function. This issue was reported through OSS-Fuzz, highlighting a crash state that can lead to potential unauthorized access or manipulation of sensitive data. The crash occurs in the process of updating binary authentication, which may expose the system to further attacks if exploited.
How To Fix
Minimum fixed version
39e8771238adf2e3ea0c3b23285b6825a8feaceb
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the 'write_publickey' function until they can apply the patch. This may involve modifying their application logic to bypass this function or using alternative methods for public key management.
Conclusion
The UNKNOWN READ vulnerability in the OpenSC package poses significant risks to users relying on its cryptographic functionalities. It is crucial to update to the patched version to ensure the security and integrity of applications utilizing OpenSC. Users are encouraged to monitor their software for vulnerabilities using tools like Vulert for ongoing protection.
See every vulnerability recorded for opensc →
FAQ
The UNKNOWN READ vulnerability is a type of error that occurs during the execution of the 'write_publickey' function, potentially leading to crashes and unauthorized access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities in real-time.
If exploited, this vulnerability could allow attackers to manipulate sensitive data or gain unauthorized access to systems relying on OpenSC for cryptographic operations.
Yes, the fixed version of OpenSC that addresses this vulnerability is 39e8771238adf2e3ea0c3b23285b6825a8feaceb.
As a temporary workaround, avoid using the 'write_publickey' function until you can apply the patch to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
