CVE-2024-11345 Overview
CVE-2024-11345 is a heap-based memory vulnerability in the PostScript interpreter used across multiple Lexmark printer and multifunction device models. Attackers can exploit the flaw over the network without authentication or user interaction to execute arbitrary code on the affected device. The weakness is classified under [CWE-787] (Out-of-Bounds Write), a common source of memory corruption bugs in language interpreters. Lexmark disclosed the issue through its security advisory portal, and the CVE was published to the National Vulnerability Database on 2025-02-13.
Critical Impact
A remote unauthenticated attacker who submits a crafted PostScript job can corrupt heap memory in the interpreter and execute arbitrary code on the affected Lexmark device.
Affected Products
- Lexmark devices running the affected PostScript interpreter firmware
- Multiple Lexmark printer and multifunction product families (refer to the Lexmark Security Advisories)
- Networked Lexmark endpoints accepting PostScript print jobs
Discovery Timeline
- 2025-02-13 - CVE-2024-11345 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11345
Vulnerability Analysis
The vulnerability resides in the PostScript interpreter embedded in Lexmark device firmware. PostScript is a stack-based, Turing-complete page description language, and interpreters must parse untrusted operand and dictionary structures before rasterizing output. An attacker crafts a PostScript document that drives the interpreter into writing past the boundary of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata or function pointers, which the attacker leverages to redirect execution.
Because the interpreter typically runs with elevated privileges on the printer, successful exploitation gives the attacker control over the device firmware context. From there, adversaries can persist on the device, harvest queued print data, or pivot into the internal network. The EPSS probability of exploitation is currently low, but printers are frequently exposed on internal networks and are a well-known pivot point for lateral movement.
Root Cause
The root cause is an out-of-bounds write ([CWE-787]) in the heap memory management logic of the PostScript interpreter. Insufficient bounds validation on attacker-controlled input allows the interpreter to write beyond the allocated buffer, corrupting adjacent heap structures.
Attack Vector
The attack is delivered over the network. An attacker submits a malicious PostScript job through any interface accepting print data, such as raw port 9100, Internet Printing Protocol (IPP), or Line Printer Daemon (LPD). No credentials or user interaction are required, and the attacker only needs network reachability to the printer's print service.
No public exploit or proof-of-concept code is available. See the Lexmark Security Advisories for vendor technical detail.
Detection Methods for CVE-2024-11345
Indicators of Compromise
- Unexpected PostScript jobs originating from unusual internal or external hosts targeting TCP/9100, TCP/515, or TCP/631
- Lexmark device crashes, spontaneous reboots, or interpreter faults recorded in device event logs
- Outbound connections from printer management interfaces to previously unseen destinations
Detection Strategies
- Inspect print traffic for oversized or malformed PostScript operators and dictionaries that deviate from normal driver output
- Correlate device firmware crash events with preceding print job submissions in centralized logs
- Monitor for unauthenticated print submissions from network segments that should not reach printer resources
Monitoring Recommendations
- Forward Lexmark device syslog to a centralized SIEM and alert on repeated interpreter errors
- Baseline printer network behavior and alert on outbound connections from printer VLANs
- Track firmware versions across the Lexmark fleet and flag devices running unpatched builds
How to Mitigate CVE-2024-11345
Immediate Actions Required
- Apply the Lexmark firmware update referenced in the vendor advisory to every affected device
- Restrict TCP/9100, TCP/515, and TCP/631 to authorized print servers using network access control lists
- Place printers in a dedicated VLAN isolated from user workstations and sensitive server subnets
- Disable direct printer access from the internet and verify no Lexmark devices are exposed publicly
Patch Information
Lexmark has published fixed firmware for affected models. Consult the Lexmark Security Advisories page to identify the correct firmware build for each model and deploy it through the standard Lexmark firmware update process.
Workarounds
- Block PostScript job submission at the network layer where firmware updates cannot be applied immediately
- Require print jobs to transit an authenticated print server rather than reach printers directly
- Disable unused print protocols and management services on the device to reduce the attack surface
# Example: restrict printer access to a dedicated print server (Linux iptables)
iptables -A FORWARD -p tcp -d <printer_ip> --dport 9100 -s <print_server_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <printer_ip> --dport 9100 -j DROP
iptables -A FORWARD -p tcp -d <printer_ip> --dport 515 -j DROP
iptables -A FORWARD -p tcp -d <printer_ip> --dport 631 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
