Visa Kernel 3 expiry-binding security flaw
VulnerabilityFirst reported
Last updated
Happening score
H score
1
Summary
Hide ▲
Show ▼
A Visa Kernel 3 expiry-binding flaw lets attackers rewrite the terminal-facing Application Expiration Date (5F24) so an expired contactless card can still be approved for in-store purchases.
Timeline
-
20.08.2026 15:01 2 articles · 2h ago
University of Massachusetts Amherst discloses Zombie Card Visa Kernel 3 flaw
Initial DisclosureUniversity of Massachusetts Amherst researchers disclosed Zombie Card, a Visa contactless payment flaw in Kernel 3 where a man-in-the-middle NFC relay can rewrite the terminal-facing Application Expiration Date (5F24) so an expired card can complete in-store purchases without breaking the card's cryptography. The findings were presented at the 35th USENIX Security Symposium in Baltimore from August 12 to 14, 2026.
Show sources
- Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments — thehackernews.com — 20.08.2026 15:01
- Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments — thehackernews.com — 20.08.2026 15:01