CVE-2023-24872

Deeper analysis

Microsoft PostScript and PCL6 Class Printer Driver is affected by a remote code execution vulnerability tracked as CVE-2023-24872. The flaw carries a CVSS 3.1 score of 8.8 and is associated with out-of-bounds read behavior (CWE-125). It was disclosed on 14 March 2023 and impacts the affected printer driver components when processing certain print jobs over the network.

An attacker with low privileges and network access can exploit the issue without user interaction, resulting in full compromise of confidentiality, integrity, and availability on the target system. The attack vector is rated as network-reachable with low complexity and unchanged scope, allowing remote code execution in the context of the driver process.

Microsoft security advisories at the referenced update guide URL describe the availability of patches that address the vulnerability; administrators are directed to apply the updates through standard Windows update channels. The EPSS score remains flat at 0.1122 with no material increase after disclosure.