CVE-2016-10109: Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of servic...

Security readout for executives and security teams

CVE-2016-10109 is a crash vulnerability in pcsc-lite, software commonly used for smart-card access. In versions before 1.8.20, a crafted interaction can trigger use of memory after it was released, causing denial of service. The bundle does not show data theft, code execution, or confirmed active exploitation. Exposure is most likely on Linux systems or images that include vulnerable pcsc-lite packages for smart-card or PC/SC functionality. The bundle names Debian, Ubuntu, Gentoo, and later container-image vulnerability tracking, but affected package status must be verified per distribution because backported fixes may keep older version numbers. Prioritize normal security patching for systems that depend on smart-card services or ship pcsc-lite in base images. Escalate if the service is reachable by untrusted users or supports critical authentication workflows, because exploitation could disrupt availability. Mitigation focus: Upgrade pcsc-lite to 1.8.20 or a vendor-patched package.; Apply Debian, Ubuntu, Gentoo, or relevant distribution security updates.; Check vendor guidance for backported fixes before relying only on version strings..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.