CVE-2024-1454Low· 3.4▾ SunlitThe use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
opensc 0.25.0openscopenscopenscRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-40661Medium· 5.4Opensc: multiple memory issues with pkcs15-init (enrollment tool)
CVE-2023-40660Medium· 6.6Opensc: potential pin bypass when card tracks its own login state
CVE-2023-5992Medium· 5.6Opensc: side-channel leaks while stripping encryption pkcs#1 padding
CVE-2026-103531Medium· 5.5A flaw has been found in OpenSC up to 0.27.1
CVE-2025-13763Medium· 5.7Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash
CVE-2024-8443Low· 2.9A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver