CVE-2023-35177

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-30 · updated 2026-06-25
Weakness: CWE-787

Description

Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser.

Affected products

HP Laserjet Pro M304-M305 W1A46A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M304-M305 W1A47A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M304-M305 W1A48A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M304-M305 W1A66A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 93M22A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A51A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A52A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A53A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A56A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A57A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A58A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A59A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A60A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M404-M405 W1A63A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y40A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y41A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y43A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y44A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y45A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y46A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro M453-M454 W1Y47A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 F W1A29A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 F W1A30A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 F W1A32A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 F W1A34A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 F W1A35A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 F W1A38A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 W1A28A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 W1A31A Firmware: before 002_2322c — fixed in 002_2322c
HP Laserjet Pro Mfp M428-M429 W1A33A Firmware: before 002_2322c — fixed in 002_2322c

How to fix

Upgrade to a fixed version: HP Laserjet Pro M304-M305 W1A46A Firmware 002_2322c; HP Laserjet Pro M304-M305 W1A47A Firmware 002_2322c; HP Laserjet Pro M304-M305 W1A48A Firmware 002_2322c; HP Laserjet Pro M304-M305 W1A66A Firmware 002_2322c; HP Laserjet Pro M404-M405 93M22A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A51A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A52A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A53A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A56A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A57A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A58A Firmware 002_2322c; HP Laserjet Pro M404-M405 W1A59A Firmware 002_2322c. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-35177 or the next vulnerability affects your stack