Read the docs
TI-2022-11334 Aliases CVE-2022-28690GHSA-7273-hmfq-x6vx

Out-of-bounds write in Horner Automation Cscape Csfont

Priority LOW 38CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

The affected product is vulnerable to an out-of-bounds write via uninitialized pointer, which may allow an attacker to execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00947 61st percentileScored 2026-11-07
Fix Fixed Horner Automation Cscape Csfont (Horner Automation): Versions 9.90 SP5 (v9.90.196)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Horner AutomationHorner Automation Cscape CsfontAll to before Versions 9.90 SP5 (v9.90.196)Versions 9.90 SP5 (v9.90.196)Patch availableCNA
  • Horner Automation Cscape Csfont VendorHorner Automation Affected All to before Versions 9.90 SP5 (v9.90.196) Fixed in Versions 9.90 SP5 (v9.90.196) Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:*before 9.90VulnerableHorner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:-:*:*:*:*:*:*9.90VulnerableHorner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp1:*:*:*:*:*:*9.90 sp1VulnerableHorner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp2:*:*:*:*:*:*9.90 sp2VulnerableHorner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp3:*:*:*:*:*:*9.90 sp3VulnerableHorner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp4:*:*:*:*:*:*9.90 sp4VulnerableHorner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp5:*:*:*:*:*:*9.90 sp5VulnerableHorner Automation
  • cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:* Versions before 9.90 Vulnerable ·Horner Automation
  • cpe:2.3:a:hornerautomation:cscape:9.90:-:*:*:*:*:*:* Versions 9.90 Vulnerable ·Horner Automation
  • cpe:2.3:a:hornerautomation:cscape:9.90:sp1:*:*:*:*:*:* Versions 9.90 sp1 Vulnerable ·Horner Automation
  • cpe:2.3:a:hornerautomation:cscape:9.90:sp2:*:*:*:*:*:* Versions 9.90 sp2 Vulnerable ·Horner Automation
  • cpe:2.3:a:hornerautomation:cscape:9.90:sp3:*:*:*:*:*:* Versions 9.90 sp3 Vulnerable ·Horner Automation
  • cpe:2.3:a:hornerautomation:cscape:9.90:sp4:*:*:*:*:*:* Versions 9.90 sp4 Vulnerable ·Horner Automation
  • cpe:2.3:a:hornerautomation:cscape:9.90:sp5:*:*:*:*:*:* Versions 9.90 sp5 Vulnerable ·Horner Automation

Remediation

  • Fix · CNA Horner Automation Cscape Csfont (Horner Automation) Fixed in Versions 9.90 SP5 (v9.90.196)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Horner Automation Cscape Csfont Versions 9.90 SP5 (v9.90.196)

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2022-12696 Heap-based buffer overflow in Horner Automation Cscape CsfontPriority LOW 38
    • TI-2022-11950 Out-of-bounds read in Horner Automation Cscape CsfontPriority LOW 38
    • TI-2022-10308 Out-of-bounds write in Horner Automation Cscape CsfontPriority LOW 38
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28690
  2. 2026-10-03 Alias added: GHSA-7273-hmfq-x6vx

References

Advisory 1

  • TI-2022-12696 Heap-based buffer overflow in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
  • TI-2022-11950 Out-of-bounds read in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
  • TI-2022-10308 Out-of-bounds write in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
  • TI-2019-10177 Out-of-bounds write in Horner Automation Cscape CVSS 3.1HIGH 7.8
  • TI-2019-10173 Improper input validation in Horner Automation Cscape CVSS 3.1HIGH 7.8
  • TI-2021-05556 Out-of-bounds read in Cscape CVSS 3.1HIGH 7.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences