The vulnerability is due to multiple uses of an uninitialized variable within the libopensc component, specifically impacting the handling of APDU responses from USB devices or smart cards. An attacker can create a crafted smart card or USB device that returns specially formulated responses, leading the library to read memory that has not been initialized. Depending on the context, this behavior can leak sensitive data that the process was not intended to expose, or it can trigger a crash of the application utilizing libopensc. The affected weakness is classified as CWE‑457, an Uninitialized Variable flaw.

The affected products are the OpenSC library (OpenSC:OpenSC) and Red Hat Enterprise Linux distributions including versions 7, 8, 9, and 10. Specific vulnerable versions are not listed in the advisory; any release containing the uninitialized variable logic remains potentially impacted until a patch is released.

This flaw carries a CVSS score of 5.7, indicating a moderate severity. The EPSS score is reported as less than 1 %, suggesting a very low but non‑zero probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to provide a malicious USB device or smart card that interacts with the target system, implying a local or physical device attack vector. Given the limited exploitability and moderate severity, the overall risk is considered moderate until a vendor patch becomes available.