Reported on 2026-04-27 by Ciwan Öztopal:

The bug is in the SmartCard-HSM driver in scd/app-sc-hsm.c. The decrypt
path uses a fixed stack buffer:

unsigned char p1blk[256];

but derives the effective RSA block size from card metadata:

p1blklen = prkdf->keysize >> 3;

The key size is parsed from the card's PrKDF metadata and is not bounded to
the size of the destination stack buffer. For RSA-4096, p1blklen becomes

512. The subsequent memcpy then writes beyond p1blk[256].

[...]

To exploit this bug a 4k RSA card must be used. Thus it is not remotely exploitable and requires access to a reader controlled by GnuPG. I consider the severity as medium.