What’s Vulnerable › Vulnerabilities

CVE-2023-40238

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-12-07 · updated 2026-06-17
• Weakness: CWE-312

Description

A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.

Affected products

• Fujitsu Celsius C780 Firmware: before 1.28.0 — fixed in 1.28.0
• Fujitsu Celsius H5511 Firmware: before 1.16 — fixed in 1.16
• Fujitsu Celsius H7510 Firmware: before 1.17 — fixed in 1.17
• Fujitsu Celsius H7613 Firmware: before 1.14 — fixed in 1.14
• Fujitsu Celsius H780 Firmware: before 1.23 — fixed in 1.23
• Fujitsu Celsius H980 Firmware: all versions
• Fujitsu Celsius J5010 Firmware: before 1.64.0 — fixed in 1.64.0
• Fujitsu Celsius J550/2 Firmware: before 1.35.0 — fixed in 1.35.0
• Fujitsu Celsius J580 Firmware: before 1.38.0 — fixed in 1.38.0
• Fujitsu Celsius M7010 Firmware: before 1.12.0 — fixed in 1.12.0
• Fujitsu Celsius M7010Power Firmware: before 1.12.0 — fixed in 1.12.0
• Fujitsu Celsius M7010X Firmware: before 1.06.0 — fixed in 1.06.0
• Fujitsu Celsius M7010Xpower Firmware: before 1.06.0 — fixed in 1.06.0
• Fujitsu Celsius R970 Firmware: before 1.14.0 — fixed in 1.14.0
• Fujitsu Celsius R970B Firmware: before 1.14.0 — fixed in 1.14.0
• Fujitsu Celsius R970Bpower Firmware: before 1.14.0 — fixed in 1.14.0
• Fujitsu Celsius W5010/L Firmware: before 1.64.0 — fixed in 1.64.0
• Fujitsu Celsius W5010 Firmware: before 1.64.0 — fixed in 1.64.0
• Fujitsu Celsius W5011 Firmware: before 1.31.0 — fixed in 1.31.0
• Fujitsu Celsius W5012-Ll Firmware: before 3.08.0 — fixed in 3.08.0
• Fujitsu Celsius W5012 Firmware: before 3.08.0 — fixed in 3.08.0
• Fujitsu Celsius W570 Firmware: before 1.35.0 — fixed in 1.35.0
• Fujitsu Celsius W570Power+ Firmware: before 1.35.0 — fixed in 1.35.0
• Fujitsu Celsius W570Power Firmware: before 1.35.0 — fixed in 1.35.0
• Fujitsu Celsius W580 Firmware: before 1.38.0 — fixed in 1.38.0
• Fujitsu Celsius W580Power+ Firmware: before 1.38.0 — fixed in 1.38.0
• Fujitsu Celsius W580Power Firmware: before 1.38.0 — fixed in 1.38.0
• Fujitsu Esprimo D556/2 Firmware: before 1.35.0 — fixed in 1.35.0
• Fujitsu Esprimo D6011 Firmware: before 1.31.0 — fixed in 1.31.0
• Fujitsu Esprimo D6012 Firmware: before 3.08.0 — fixed in 3.08.0

How to fix

Upgrade to a fixed version: Fujitsu Celsius C780 Firmware 1.28.0; Fujitsu Celsius H5511 Firmware 1.16; Fujitsu Celsius H7510 Firmware 1.17; Fujitsu Celsius H7613 Firmware 1.14; Fujitsu Celsius H780 Firmware 1.23; Fujitsu Celsius J5010 Firmware 1.64.0; Fujitsu Celsius J550/2 Firmware 1.35.0; Fujitsu Celsius J580 Firmware 1.38.0; Fujitsu Celsius M7010 Firmware 1.12.0; Fujitsu Celsius M7010Power Firmware 1.12.0; Fujitsu Celsius M7010X Firmware 1.06.0; Fujitsu Celsius M7010Xpower Firmware 1.06.0. Check the vendor advisory for mitigations.

References

• https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html
• https://security.netapp.com/advisory/ntap-20240105-0002/
• https://www.insyde.com/security-pledge
• https://www.insyde.com/security-pledge/SA-2023053
• https://www.kb.cert.org/vuls/id/811862
• https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html
• https://security.netapp.com/advisory/ntap-20240105-0002/
• https://www.insyde.com/security-pledge
• https://www.insyde.com/security-pledge/SA-2023053
• https://www.kb.cert.org/vuls/id/811862

Get alerted when CVE-2023-40238 or the next vulnerability affects your stack