cve 2023 2977

CVE-2023-2977 is a security vulnerability in OpenSC, an open-source smart card toolkit. The bug resides in the ASN.1 parsing code within the pkcs15-cardos codepath, causing a heap-based out-of-bounds read. This flaw has prompted multiple Linux distributors to ship security updates and implement source-level fixes in downstream package trees. OpenSC is widely used in Linux distributions for smart card authentication, code signing, and PKCS#15 token operations. The vulnerability highlights the importance of careful ASN.1 parsing in cryptographic software.