CVE-2023-24883
Published: 11 April 2023
Summary
CVE-2023-24883 is a medium-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 5.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-24883 is an information disclosure vulnerability in the Microsoft PostScript and PCL6 Class Printer Driver, carrying a CVSS 3.1 base score of 6.5. The flaw is associated with CWE-126 and permits unauthorized exposure of sensitive data when the affected driver components process certain inputs.
An attacker with low privileges can exploit the issue over a network connection without user interaction, resulting in high-impact confidentiality loss while leaving integrity and availability unaffected. The attack vector requires only standard authenticated access to a system using the vulnerable printer driver.
Microsoft security advisories published at msrc.microsoft.com recommend applying the vendor-supplied updates referenced under CVE-2023-24883 to address the exposure. The associated EPSS score has remained steady at 0.1263 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28873
Vulnerability details
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.