CVE-2023-40238: Fujitsu Celsius c780 Firmware

Medium severity, CVSS 5.5. EPSS: 1.8% chance of exploitation in the next 30 days.

A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.

Affected products

• Fujitsu Celsius c780 Firmware: before 1.28.0 (fixed in 1.28.0)
• Fujitsu Celsius h5511 Firmware: before 1.16 (fixed in 1.16)
• Fujitsu Celsius h7510 Firmware: before 1.17 (fixed in 1.17)
• Fujitsu Celsius h7613 Firmware: before 1.14 (fixed in 1.14)
• Fujitsu Celsius h780 Firmware: before 1.23 (fixed in 1.23)
• Fujitsu Celsius h980 Firmware: affected versions not specified
• Fujitsu Celsius j5010 Firmware: before 1.64.0 (fixed in 1.64.0)
• Fujitsu Celsius j550/2 Firmware: before 1.35.0 (fixed in 1.35.0)
• Fujitsu Celsius j580 Firmware: before 1.38.0 (fixed in 1.38.0)
• Fujitsu Celsius m7010 Firmware: before 1.12.0 (fixed in 1.12.0)
• Fujitsu Celsius m7010power Firmware: before 1.12.0 (fixed in 1.12.0)
• Fujitsu Celsius m7010x Firmware: before 1.06.0 (fixed in 1.06.0)
• Fujitsu Celsius m7010xpower Firmware: before 1.06.0 (fixed in 1.06.0)
• Fujitsu Celsius r970 Firmware: before 1.14.0 (fixed in 1.14.0)
• Fujitsu Celsius r970b Firmware: before 1.14.0 (fixed in 1.14.0)
• Fujitsu Celsius r970bpower Firmware: before 1.14.0 (fixed in 1.14.0)
• Fujitsu Celsius w5010/l Firmware: before 1.64.0 (fixed in 1.64.0)
• Fujitsu Celsius w5010 Firmware: before 1.64.0 (fixed in 1.64.0)
• Fujitsu Celsius w5011 Firmware: before 1.31.0 (fixed in 1.31.0)
• Fujitsu Celsius w5012-Ll Firmware: before 3.08.0 (fixed in 3.08.0)
• Fujitsu Celsius w5012 Firmware: before 3.08.0 (fixed in 3.08.0)
• Fujitsu Celsius w570 Firmware: before 1.35.0 (fixed in 1.35.0)
• Fujitsu Celsius w570power+ Firmware: before 1.35.0 (fixed in 1.35.0)
• Fujitsu Celsius w570power Firmware: before 1.35.0 (fixed in 1.35.0)
• Fujitsu Celsius w580 Firmware: before 1.38.0 (fixed in 1.38.0)
• and 162 more

Published 2023-12-07. Last modified 2026-06-17.