CVE-2024-45615 Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init

Low 3.9 Published 3 Sep 2024 Updated 30 Jun 2026

Uninitialized variables in OpenSC pkcs15init may lead to undefined behavior or information disclosure during smart card initialization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-45615?

CVE-2024-45615 is a low-severity vulnerability in Opensc Project Opensc, published on 3 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.).

Weakness: CWE-908, CWE-457

Which versions are affected by CVE-2024-45615?

It affects 2 products.

Products include Opensc Project Opensc, Redhat Enterprise Linux.

How do I fix CVE-2024-45615?

Apply the vendor's patch.

Is CVE-2024-45615 being exploited?

There is no known exploitation of CVE-2024-45615 in the wild and no public exploit code.

All Opensc Project Opensc vulnerabilities

Sources

Also known as AZL-48723, AZL-48832, BELL-CVE-2024-45615, DEBIAN-CVE-2024-45615, GHSA-3q68-hm47-94vg, UBUNTU-CVE-2024-45615.