CVE-2025-66037

CVE-2025-66037 is a medium-severity out-of-bounds heap read vulnerability affecting OpenSC versions prior to 0.27.0. This flaw occurs in the X.509/SPKI handling path when processing specially crafted input, leading to a zero-length buffer being allocated and then read past its end. Rated with a CVSS score of 6.8, successful exploitation requires physical access to the system but can result in high impact to confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or inclusion on the CISA KEV catalog. The issue has been addressed in OpenSC version 0.27.0, and community discussions reflect awareness of the patch.