ANT-2026-GSDN3H7W · opensc

stack-buffer-overflow low

CVE-2026-40528

Severity Claude low · Security research firm low · Maintainer low

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-GSDN3H7W: Stack buffer overflow in do_key_value profile parsing via unbounded memcpy into 32-byte buffer

An unbounded memcpy in do_key_value copies profile data into a fixed 32-byte stack buffer, overflowing it.

Target

Project: opensc
Location: do_key_value()
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-GSDN3H7W.

Reference: ANT-2026-GSDN3H7W
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: true positive
Severity: low

TIMELINE

Dates from discovery through public reveal.

2026-03-03 Sent to maintainer
2026-03-29 Reported to tracker
2026-03-29 Patch released
2026-05-09 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

ce928e32f2d40c5afc3911f86cbf75774a72defba7331a4233ba68f846447e71482974fd708e1b7137ccf7edcae245f89826cfeb3b038c4fa962703b3640efdb

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-GSDN3H7W",
  "bug_class": "Stack Buffer Overflow",
  "claude_severity": "low",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:23+00:00",
  "description": "An unbounded memcpy in do_key_value copies profile data into a fixed 32-byte stack buffer, overflowing it.",
  "discovered_at": null,
  "location": "do_key_value()",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "OpenSC",
  "reproduction": null,
  "technical_details": null,
  "title": "Stack buffer overflow in do_key_value profile parsing via unbounded memcpy into 32-byte buffer",
  "vendor_severity": "low"
}