CVE-2024-11345

Vulnerability

Overview CVE-2024-11345 is a heap-based memory vulnerability found in the Postscript interpreter of various Lexmark devices. The flaw exists in the handling of memory allocation during Postscript processing, leading to potential memory corruption. This root cause enables an attacker to manipulate memory structures and execute arbitrary code.

Exploitation and

Attack Surface To exploit this vulnerability, an attacker must deliver a specially crafted Postscript file to the target device. This could be achieved through direct printing or network-based printing services if the device accepts print jobs. No authentication is required if the device is exposed to untrusted networks, but typical deployments may require network access to the printer.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process, which often runs with elevated permissions. This can lead to full compromise of the device, including data theft, unauthorized access to network resources, or use of the device as a pivot point for further attacks.

Mitigation

Lexmark has addressed this vulnerability in security updates. Users are advised to apply the latest firmware updates from Lexmark's security advisory page [1]. No workarounds are available if patching is not immediately possible.