A heap-based buffer overflow vulnerability exists in the libopensc OpenPGP driver, triggered by malicious APDU responses from a crafted USB device or smart card during the enrollment process with the pkcs15-init tool. This vulnerability can cause out-of-bound memory access, which may lead to arbitrary code execution. The affected version explicitly stated is 0.26.0. The CVSS v3.1 base score is 2.9, indicating low severity due to attack complexity and required user interaction. The vendor advisory from Red Hat is available but does not specify patch or remediation status in the provided excerpt.

The vulnerability allows a local attacker with physical access to a USB device or smart card to cause a heap-based buffer overflow during card enrollment, potentially leading to arbitrary code execution. However, the low CVSS score and attack vector (physical access, high attack complexity, user interaction required) limit the impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2024-8443 for current remediation guidance. Until an official fix is confirmed, avoid using untrusted USB devices or smart cards with the pkcs15-init tool. Monitor vendor communications for updates on patches or workarounds.