CVE-2025-13763

import sys # Conceptual PoC for CVE-2025-13763 # This script demonstrates the logic of triggering the uninitialized variable usage. # In a real scenario, a specialized hardware device (USB/Smart Card) is required. def send_crafted_apdu(): # Simulating a crafted APDU response that targets the uninitialized memory read crafted_apdu = b"\x00\xA4\x04\x00\x0A" # Example header print(f"[*] Connecting to target interface...") print(f"[*] Sending crafted APDU: {crafted_apdu.hex()}") # The vulnerable library (libopensc) processes this response # without initializing variables, leading to potential crash or leak. print("[!] Triggering uninitialized variable usage in libopensc...") print("[!] Outcome: Potential Information Disclosure or Crash.") if __name__ == "__main__": send_crafted_apdu()

{"cve": {"id": "CVE-2025-13763", "sourceIdentifier": "[email protected]", "published": "2026-04-23T13:16:09.697", "lastModified": "2026-04-24T14:50:56.203", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 5.7, "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.5, "impactScore": 5.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-457"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-13763", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2417581", "source": "[email protected]"}, {"url": "https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv", "source": "[email protected]"}, {"url": "https://github.com/OpenSC/OpenSC/wiki/CVE-2025-13763", "source": "[email protected]"}, {"url": "https://github.com/OpenSC/OpenSC/security/advisories/GHSA-2v44-fq35-98vv", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}