The vulnerability CVE-2024-45618 in OpenSC's pkcs15-init occurs due to improper handling of return values from functions, resulting in the use of uninitialized variables. An attacker controlling a USB device or smart card can send crafted APDU responses that trigger this condition. The CVSS 3.1 base score is 3.9, indicating low severity, with attack vector being physical (local device), high attack complexity, no privileges required, and no user interaction needed. The impact includes low confidentiality, integrity, and availability impacts. No known exploits are reported in the wild. The Red Hat advisory linked does not explicitly mention a patch or remediation status.

The vulnerability could allow an attacker with physical access to the system to cause the software to operate with uninitialized variables, potentially leading to unexpected behavior affecting confidentiality, integrity, and availability at a low level. There is no indication of remote exploitation or privilege escalation. The overall impact is low.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2024-45618 for current remediation guidance. Until a patch is available, limit exposure to untrusted USB devices or smart cards to reduce risk.