{"api_version":"1","generated_at":"2026-07-23T16:45:03+00:00","cve":"CVE-2025-13763","urls":{"html":"https://cve.report/CVE-2025-13763","api":"https://cve.report/api/cve/CVE-2025-13763.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-13763","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-13763"},"summary":{"title":"Libopensc: opensc: multiple uses of uninitialized variable","description":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","state":"PUBLISHED","assigner":"redhat","published_at":"2026-04-23 13:16:09","updated_at":"2026-06-30 07:16:30"},"problem_types":["CWE-457","CWE-457 CWE-457 Use of Uninitialized Variable"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Secondary","score":"5.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-13763","name":"https://access.redhat.com/security/cve/CVE-2025-13763","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2417581","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2417581","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763","name":"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv","name":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13763","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13763","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"OpenSC","product":"OpenSC","version":"affected 0.27.0 semver","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2025-11-27T14:28:07.219Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-04-23T12:09:46.867Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"To mitigate this issue, avoid connecting untrusted USB devices or smart cards to systems running affected versions of Red Hat Enterprise Linux. This operational control reduces the risk of an attacker presenting a specially crafted device to exploit the uninitialized variable flaws in `libopensc`.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"13763","cve":"CVE-2025-13763","epss":"0.001760000","percentile":"0.073150000","score_date":"2026-07-04","updated_at":"2026-07-05 00:02:28"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-13763","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T14:04:28.240123Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-457","description":"CWE-457 Use of Uninitialized Variable","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-23T14:05:23.182Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"OpenSC","vendor":"OpenSC","versions":[{"lessThan":"0.27.0","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"opensc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"affected","packageName":"opensc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"opensc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"opensc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"datePublic":"2026-04-23T12:09:46.867Z","descriptions":[{"lang":"en","value":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs"}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Low"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"format":"CVSS"}],"providerMetadata":{"dateUpdated":"2026-06-30T06:49:30.039Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-13763"},{"name":"RHBZ#2417581","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2417581"},{"url":"https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv"},{"url":"https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763"}],"timeline":[{"lang":"en","time":"2025-11-27T14:28:07.219Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-23T12:09:46.867Z","value":"Made public."}],"title":"Libopensc: opensc: multiple uses of uninitialized variable","workarounds":[{"lang":"en","value":"To mitigate this issue, avoid connecting untrusted USB devices or smart cards to systems running affected versions of Red Hat Enterprise Linux. This operational control reduces the risk of an attacker presenting a specially crafted device to exploit the uninitialized variable flaws in `libopensc`."}],"x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2025-13763","datePublished":"2026-04-23T12:27:41.820Z","dateReserved":"2025-11-27T14:35:05.731Z","dateUpdated":"2026-06-30T06:49:30.039Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-23 13:16:09","lastModifiedDate":"2026-06-30 07:16:30","problem_types":["CWE-457","CWE-457 CWE-457 Use of Uninitialized Variable"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-23T14:04:28.240123Z","id":"CVE-2025-13763","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"13763","Ordinal":"1","Title":"Libopensc: opensc: multiple uses of uninitialized variable","CVE":"CVE-2025-13763","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"13763","Ordinal":"1","NoteData":"Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs","Type":"Description","Title":"Libopensc: opensc: multiple uses of uninitialized variable"}]}}}