CVE-2023-33221: Idemia Morphowave Compact Firmware

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

When reading DesFire keys, the function that reads the card isn't properly checking the boundaries when copying internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code Execution on the targeted device. This is especially problematic if you use Default DESFire key.

Affected products

• Idemia Morphowave Compact Firmware: before 2.12.2 (fixed in 2.12.2)
• Idemia Morphowave SP Firmware: before 1.2.7 (fixed in 1.2.7)
• Idemia Morphowave XP Firmware: before 2.12.2 (fixed in 2.12.2)
• Idemia Sigma Extreme Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Lite+ Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Lite Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Sigma Wide Firmware: before 4.15.5 (fixed in 4.15.5)
• Idemia Visionpass Firmware: before 2.12.2 (fixed in 2.12.2)

Published 2023-12-15. Last modified 2026-06-17.