Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0872

NIXPKGS-2026-0872
published on
Permalink CVE-2025-66037
3.9 LOW
  • CVSS version: 3.1
  • Attack vector (AV): PHYSICAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 1 month ago by @mweinelt Activity log
  • Created suggestion 1 month ago
  • @mweinelt ignored
    11 packages
    • openscad
    • openscap
    • openscreen
    • openscad-lsp
    • openscenegraph
    • openscad-unstable
    • kakounePlugins.openscad-kak
    • vscode-extensions.antyos.openscad
    • tree-sitter-grammars.tree-sitter-openscad
    • python313Packages.tree-sitter-grammars.tree-sitter-openscad
    • python314Packages.tree-sitter-grammars.tree-sitter-openscad
    1 month ago
  • @mweinelt accepted 1 month ago
  • @mweinelt published on GitHub 1 month ago
OpenSC: Out of Bounds vulnerability

OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.

Affected products

OpenSC
  • ==< 0.27.0

Matching in nixpkgs

pkgs.opensc

Set of libraries and utilities to access smart cards

Ignored packages (11)

pkgs.openscreen

Free, open-source alternative to Screen Studio (sort of)

pkgs.openscad-lsp

LSP (Language Server Protocol) server for OpenSCAD

Package maintainers

https://github.com/OpenSC/OpenSC/security/advisories/GHSA-m58q-rmjm-mmfx