Access of Resource Using Incompatible Type in Postscript interpreter
Priority LOW 38CWE-843Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) allows Resource Injection.This issue affects CX, XC, CS, et. Al.: from 001.001:0 through 081.231, from *.*.P001 through *.*.P233, from *.*.P001 through *.*.P759, from *.*.P001 through *.*.P836.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00448 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lexmark International | CX, XC, CS, MS, MX, XM, et. al. | up to CXTLS.240.076; CXTLS.240.200 and later; up to MXTLS.240.076; MXTLS.240.200 and later; up to CSTLS.240.076; CSTLS.240.200 and later; up to MSNSN.240.042; MSNSN.240.200 and later; up to MSTSN.240.042; MSTSN.240.200 and later; up to MXTSN.240.042; MXTSN.240.200 and later; up to CSNGV.240.042; CSNGV.240.200 and later; up to CSTGV.240.042; CSTGV.240.200 and later; up to CXTGV.240.042; CXTGV.240.200 and later; up to CXTPC.240.042; CXTPC.240.200 and later; up to CSTPC.240.042; CSTPC.240.200 and later; up to MXTCT.240.042; MXTCT.240.200 and later; up to MXTPM.240.042; MXTPM.240.200 and later; up to CXTMM.240.042; CXTMM.240.200 and later; up to CSTMM.240.042; CSTMM.240.200 and later; up to CSTZJ.240.042; CSTZJ.240.200 and later; up to CSNZJ.240.042; CSNZJ.240.200 and later; up to CXTZJ.240.042; CXTZJ.240.200 and later; up to CXNZJ.240.042; CXNZJ.240.200 and later; up to MSNGM.240.042; MSNGM.240.200 and later; up to MSLSG.230.401; up to MXLSG.230.401; up to MSLBD.230.401; up to MXLBD.230.401; up to CSLBN.230.401; up to CSLBL.230.401; up to CXLBN.230.401; up to CXLBL.230.401; up to CXTPP.230.401; up to CSTPP.230.401; up to CSTAT.230.401; up to CXTAT.230.401; up to CSTMH.230.401; up to CXTMH.230.401; up to LW90.TL2.P215; up to LW90.PR2.P215; up to LW90.PR4.P215; up to LW90.SB4.P215; up to LW90.SB7.P215; up to LW90.DN2.P215; up to LW90.DN4.P215; up to LW90.DN7.P215; up to LW90.TU.P215; up to LW90.SA.P215; up to LW90.MG.P215; up to LW90.GM7.P215; up to LW90.GM4.P215; up to LW90.VY4.P215; up to LW80.PRL.P257; up to LW80.SB2.P257; up to LW80.VYL.P257; up to LW80.VY2.P257; up to LW80.GM2.P257 | — | No fix listed | CNA |
- CX, XC, CS, MS, MX, XM, et. al. VendorLexmark International Affected up to CXTLS.240.076; CXTLS.240.200 and later; up to MXTLS.240.076; MXTLS.240.200 and later; up to CSTLS.240.076; CSTLS.240.200 and later; up to MSNSN.240.042; MSNSN.240.200 and later; up to MSTSN.240.042; MSTSN.240.200 and later; up to MXTSN.240.042; MXTSN.240.200 and later; up to CSNGV.240.042; CSNGV.240.200 and later; up to CSTGV.240.042; CSTGV.240.200 and later; up to CXTGV.240.042; CXTGV.240.200 and later; up to CXTPC.240.042; CXTPC.240.200 and later; up to CSTPC.240.042; CSTPC.240.200 and later; up to MXTCT.240.042; MXTCT.240.200 and later; up to MXTPM.240.042; MXTPM.240.200 and later; up to CXTMM.240.042; CXTMM.240.200 and later; up to CSTMM.240.042; CSTMM.240.200 and later; up to CSTZJ.240.042; CSTZJ.240.200 and later; up to CSNZJ.240.042; CSNZJ.240.200 and later; up to CXTZJ.240.042; CXTZJ.240.200 and later; up to CXNZJ.240.042; CXNZJ.240.200 and later; up to MSNGM.240.042; MSNGM.240.200 and later; up to MSLSG.230.401; up to MXLSG.230.401; up to MSLBD.230.401; up to MXLBD.230.401; up to CSLBN.230.401; up to CSLBL.230.401; up to CXLBN.230.401; up to CXLBL.230.401; up to CXTPP.230.401; up to CSTPP.230.401; up to CSTAT.230.401; up to CXTAT.230.401; up to CSTMH.230.401; up to CXTMH.230.401; up to LW90.TL2.P215; up to LW90.PR2.P215; up to LW90.PR4.P215; up to LW90.SB4.P215; up to LW90.SB7.P215; up to LW90.DN2.P215; up to LW90.DN4.P215; up to LW90.DN7.P215; up to LW90.TU.P215; up to LW90.SA.P215; up to LW90.MG.P215; up to LW90.GM7.P215; up to LW90.GM4.P215; up to LW90.VY4.P215; up to LW80.PRL.P257; up to LW80.SB2.P257; up to LW80.VYL.P257; up to LW80.VY2.P257; up to LW80.GM2.P257 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11346
- 2026-10-03 Alias added: GHSA-xp3p-hpx6-m9q4
More Lexmark International vulnerabilities
- TI-2024-10512 Access of Resource Using Incompatible Type in Postscript interpreter CVSS 3.1HIGH 7.3
- TI-2024-10510 Heap-based memory vulnerability in the Postscript interpreter in various Lexmark devices CVSS 3.1HIGH 7.3
Sources
- CVE-2024-11346 · CVE Program
- CVE-2024-11346 · NVD
- FIRST EPSS
- GHSA-xp3p-hpx6-m9q4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences