CVE-2025-11541
Published: 22 December 2025
Summary
CVE-2025-11541 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Sharp Np-P502Wlg Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow vulnerability through timely application of vendor patches or updates.
Enforces input validation to prevent buffer overflows from malicious network inputs processed by the projector.
Implements memory protection mechanisms like stack canaries or DEP to block arbitrary code execution from stack buffer overflows.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in network-exposed projector service allows remote unauthenticated arbitrary code execution, directly enabling exploitation of public-facing applications.
NVD Description
Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs.
Deeper analysisAI
CVE-2025-11541 is a stack-based buffer overflow vulnerability (CWE-121, CWE-787) in Sharp Display Solutions projectors. Published on 2025-12-22T05:16:16.460, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw enables an attacker to execute arbitrary commands and programs on affected devices.
The vulnerability can be exploited by a remote attacker requiring no privileges, user interaction, or special access, over the network with low attack complexity. Successful exploitation results in high impacts to confidentiality, integrity, and availability, allowing full compromise of the projector, including arbitrary code execution.
Mitigation details are available in the vendor advisory at https://sharp-displays.jp.sharp/global/support/info/PJ-CVE-2025-11540.html.
Details
- CWE(s)