OpenSC smartcard framework Light 0.27.1

What's new in 0.27.1

Edit 2026-04-18: Replaced the MacOS release binary due to originally uploading wrongly signed one (see #3654).

New in 0.27.1; 2026-03-31

• Bugfix release to fix up infrastructure issues. There were no 0.27.0 artifacts published.

New in 0.27.0; 2026-03-30

Security

• CVE-2025-13763: Several uses of potentially uninitialized memory detected by fuzzers
• CVE-2025-49010: Possible write beyond buffer bounds during processing of GET RESPONSE APDU
• CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
• CVE-2025-66038: Possible read beyond buffer bounds when parsing historical bytes in PIV driver
• CVE-2025-66037: Possible buffer overrun while parsing SPKI
• More low-severity data handling issues when parsing profile configuration

General improvements
- Added support for PKCS#11 3.2 in tools and pkcs11-spy and p11test(#3510)
- Added support for Ed448, X448 mechanisms and improve support for
Edwards and montgomery keys in general (#3090)
- Support CKA_PUBKEY_KEY_INFO PKCS#11 attribute (#3090)
- Various refactoring of autotools build system
- Remove obsolete tokend support (#3285)
- Run tests against different software PKCS#11 tokens kryoptic and NSS softokn (#3365)
- Removed internal caching for current EF/DF (#3403)
- Correctly detect OS-level FIPS mode in OpenSSL automatically (#3551)
or through custom configuration file (#3525)
- Added support for Brainpool twisted curves to pkcs11-tool and SC-HSM (#3601)

PC/SC
- Handle case when smart card is removed and inserted between two subsequent calls to
refresh_attributes() (#2803)

EsteID

• Add support for EstEID 2025 (#3392)
• Implement FinEID 4.0/4.1 support (#3505)
• Add Latvian IDEMIA Cosmo X card support (#3503)
• Check if PIN is locked and hint CKF_USER_PIN_TO_BE_CHANGED (#3490)
• Remove obsolete FinEID cards (#3522)
• Add Latvian Cosmo 8.2 card support (#3521)

D-Trust

• Prevent unncecessary pin prompts on pinpad readers (#3266)
• Support for D-Trust Card 5.1 & 5.4 (#3137)
• Implement PIN change and unblock in dtrust-tool (#3137)

Belpic

• Add supports for belpic applet version 1.8 (#3308)

OpenPGP

• Implement key derived PIN format (KDF-DO) as per OpenPGP card spec v3.3 (#3398)

IDPrime

• Implement 5110+ FIPS and 5110 CC (940) derive support (#3483)

Windows

• Update to Wix 6 (#3435)
• Fix C_WaitForSlotEvent() not working in Windows (#2919)
• remove pkcs11-register from autostart (#3354)

MacOS

• Installer images are now notarized (#3536)

pkcs11-tool …

Full release notes »