---
id: CVE-2024-1454
title: 'Opensc: memory use after free in authentic driver when updating token info'
summary: >-
  The use-after-free vulnerability was found in the AuthentIC driver in OpenSC
  packages, occuring in the card enrolment process using pkcs15-init when a user
  or administrator enrols or modifies cards. An attacker must have physical
  access …
severity: low
cvss: 3.4
cvssVector: 'CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-416
vendor: Red Hat
product: opensc
affected:
  - opensc 0.25.0
  - opensc
  - opensc
  - opensc
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-02-13T16:49:06.841482Z'
published: '2024-02-12'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T13:41:42.486Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-1454'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2024-1454'
  - url: 'https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2263929'
    label: RHBZ#2263929
  - url: >-
      https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9
tags:
  - cve.org
epss: 0.00422
epssPercentile: 0.36704
ingestedAt: '2026-11-06T13:52:17.099Z'
---

## Overview

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

## Affected

- `opensc 0.25.0`
- `opensc`
- `opensc`
- `opensc`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.