PT-2023-20459 · Lexmark · Lexmark Mc3224I

Published 2023-04-10 · Updated 2025-02-11 · CVE-2023-26064

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lexmark devices (affected versions not specified)

Description The issue is related to an Out-of-bounds Write, which can lead to a Heap-based Buffer Overflow and potentially allow for Remote Code Execution. This was demonstrated in a real-world scenario during Pwn2Own, where a Lexmark MC3224i device was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-26064

ZDI-23-664

Affected Products

Lexmark Mc3224I

References · 7

• https://support.lexmark.com/alerts · Vendor Advisory
• https://publications.lexmark.com/publications/security-alerts/CVE-2023-26064.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26064 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-664 · Security Note
• https://t.me/cvenotify/110849 · Telegram Post
• https://t.me/cibsecurity/61803 · Telegram Post