This vulnerability in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK arises from insufficient or missing validation of function return values, resulting in the use of uninitialized variables. An attacker controlling a USB device or smart card can present specially crafted APDU responses to trigger this condition. The issue is identified in version 0 of the affected software. The CVSS 3.1 base score is 3.9, indicating low severity with partial confidentiality, integrity, and availability impact. No vendor patch or fix information is provided in the advisory, and no exploits are known in the wild.

The vulnerability could allow an attacker with physical access to a system to cause unexpected behavior due to uninitialized variables when interacting with OpenSC components via a crafted USB device or smart card. The impact includes limited confidentiality, integrity, and availability consequences as per the CVSS score. There is no evidence of remote exploitation or widespread impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2024-45617 for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, limit exposure to untrusted USB devices or smart cards to reduce risk.