PT-2023-20461 · Lexmark · Lexmark

Published 2023-04-10 · Updated 2025-02-11 · CVE-2023-26066

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lexmark devices through 2023-02-19

Description The issue is related to Improper Validation of an Array Index, which can lead to an Out-Of-Bounds Read and potentially allow Remote Code Execution. This was demonstrated in a real-world scenario at Pwn2Own.

Recommendations For Lexmark devices through 2023-02-19, update to a version released after 2023-02-19 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2023-26066

ZDI-23-666

Affected Products

Lexmark

References · 7

• https://support.lexmark.com/alerts · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-666 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26066 · Vendor Advisory
• https://publications.lexmark.com/publications/security-alerts/CVE-2023-26066.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26066 · Security Note
• https://t.me/cibsecurity/61796 · Telegram Post
• https://t.me/cvenotify/110851 · Telegram Post