CVE-2024-8443
libopensc: Heap buffer overflow in OpenPGP driver when generating key
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 4, 2024
Updated · June 30, 2026
Description
A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the pkcs15-init tool may lead to out-of-bound rights, possibly resulting in arbitrary code execution.
Statement
As this flaw requires physical access and has a high complexity level to be exploited, it has been considered a Low severity vulnerability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 2.9CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-122 · Heap-based Buffer Overflow