CVE-2025-11541 is a critical (CVSS 9.8) stack based buffer overflow in Sharp Display Solutions projectors, including the NP-CR5450 series, that may let an attacker run commands and programs. The advisory gives a workaround and no confirmed fixed firmware: keep projectors on a firewalled intranet, off the internet, and watch Sharp support for an update.
What's affected
The CVE record lists the Sharp NP-CR5450H, NP-CR5450HL, NP-CR5450W and NP-CR5450WL projectors and their firmware. Sharp's advisory is wider. It covers four CVE identifiers (CVE-2025-11540 to CVE-2025-11543) in one notice and names these models: NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG and NP-UM352W+.
The weakness is CWE-121 (stack based buffer overflow), a child of CWE-787 (out of bounds write). Sharp's advisory groups this CVE with CVE-2025-11542, which has the same description, under attackers being able to execute arbitrary commands and programs. The record does not say which service or input triggers it, and we will not guess.
The advisory page gives a workaround and does not state a fixed firmware version. Check the advisory and Sharp support for your model before assuming a patch exists. The CVSS base score is 9.8 (Critical) with a network attack vector, no privileges and no user interaction.
How to check if you're exposed
There is no package manager for a projector, so exposure comes down to model and network position.
- Read the model number on the label or in the on-screen menu and compare it with the advisory list above.
- Find out whether the projector is reachable from anywhere other than a tightly controlled network. Look at your switch ports, DHCP leases and any port forwards on your firewall.
- Use your normal network inventory tool to see which management interfaces the projector answers on. Do not probe devices you do not own. A projector that answers from the public internet is the worst case, so check your firewall and any remote access service for rules that point at it.
- Record the firmware version shown in the projector menu and keep it with the asset record, so you can compare it with whatever Sharp publishes later.
What to do now
- Identify every Sharp projector in the advisory list, including ceiling mounted units in meeting rooms and training spaces that nobody thinks of as computers.
- Apply the vendor workaround: use the product only in a safe intranet protected by a firewall, and do not connect it to the internet. Remove any port forward or public address that points at a projector.
- Move projectors to their own network segment or VLAN, and allow only the presentation and management hosts that need them.
- Watch the Sharp advisory for firmware and update when it appears. Review the release notes first and keep a rollback plan for rooms in daily use.
- Add projectors and other network displays to your asset inventory so the next advisory is a five minute lookup.
Why it matters
A stack overflow means a program writes more data into a fixed buffer than it can hold and overwrites memory next to it. On devices without strong memory protections that can let an attacker steer execution, which is why the record talks about running arbitrary commands and programs. The CVSS vector scores confidentiality, integrity and availability all high, and requires no account.
Projectors rarely get patched. They sit in rooms, join the network once, and get forgotten, which makes an internet reachable unit an attractive pivot. The record does not mark this as a CISA Known Exploited Vulnerability and Sharp's advisory does not report attacks, so there is no sign of active exploitation. The sensible response is to control network exposure, which you can do today.
This CVE is one of four in a single advisory. Read them together, because file read, command execution and firmware tampering on the same device add up to more than any one of them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does Sharp list a patched firmware for this CVE?
The advisory page we fetched lists a workaround only and does not state a fixed firmware version. Check the advisory again and Sharp support for your model.
Is CVE-2025-11541 exploited in the wild?
No source we reviewed says so, and the record is not in the CISA KEV catalog. Reduce exposure anyway, because the severity is critical.
Sources
- Sharp Display Solutions advisory, Multiple vulnerabilities in projectors
- CVE record and CVSS vector for CVE-2025-11541, published 2025-12-22
Last reviewed: 19 October 2026.
