CVE-2024-11345
Published: 13 February 2025
Summary
CVE-2024-11345 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Lexmark (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-11345 is a heap-based memory vulnerability, classified under CWE-787, affecting the Postscript interpreter in various Lexmark devices. Published on 2025-02-13T19:15:13.200, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The issue enables attackers to execute arbitrary code by leveraging the memory corruption.
A remote attacker with no privileges or user interaction required can exploit this vulnerability over the network with low attack complexity. Exploitation results in low impacts to confidentiality, integrity, and availability, but critically allows arbitrary code execution on the targeted Lexmark device.
Lexmark provides details on this vulnerability through its security advisories page at https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html, which security practitioners should consult for mitigation guidance and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4911
Vulnerability details
A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote arbitrary code execution via memory corruption in a network-exposed Postscript interpreter on Lexmark devices maps cleanly to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching and remediation of the heap-based buffer overflow vulnerability in the Lexmark Postscript interpreter to eliminate arbitrary code execution.
Implements memory protections like ASLR and heap hardening to mitigate exploitation of the heap-based memory corruption vulnerability even if unpatched.
Mandates validation of Postscript inputs to prevent crafted malicious inputs from triggering the heap overflow and enabling remote code execution.