Vulnerability · Published Feb 20, 2024 · Assigned by hp
CVE-2024-0794Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Buffer Overflow, Potential Remote Code Execution
Critical 9.8
In plain English
A critical-severity out-of-bounds read in Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers from HP Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HP Inc. | Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers | See HP Security Bulletin reference for affected versions. |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H