CVE-2025-11542 is a critical (CVSS 9.8) stack based buffer overflow in Sharp projectors, including the NP-CR5450H, HL, W and WL models. It may let an attacker execute arbitrary commands. Sharp's advisory offers a workaround rather than a fixed firmware: use the projector on a protected intranet and never connect it to the internet.
What's affected
The CVE record lists the Sharp NP-CR5450H, NP-CR5450HL, NP-CR5450W and NP-CR5450WL projectors and their firmware. Sharp's advisory is wider. It covers four CVE identifiers (CVE-2025-11540 to CVE-2025-11543) in one notice and names these models: NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG and NP-UM352W+.
This CVE is a sibling of CVE-2025-11541 and carries the same description in the record: a stack based buffer overflow that may allow an attacker to execute arbitrary commands and programs. It is classified as CWE-121 and CWE-787. Two separate identifiers usually mean two separate code paths, so a fix for one is not proof of a fix for the other.
The advisory page gives a workaround and does not state a fixed firmware version. Check the advisory and Sharp support for your model before assuming a patch exists. The CVSS base score is 9.8 (Critical) with a network attack vector, no privileges and no user interaction.
How to check if you're exposed
There is no package manager for a projector, so exposure comes down to model and network position.
- Read the model number on the label or in the on-screen menu and compare it with the advisory list above.
- Find out whether the projector is reachable from anywhere other than a tightly controlled network. Look at your switch ports, DHCP leases and any port forwards on your firewall.
- Use your normal network inventory tool to see which management interfaces the projector answers on. Do not probe devices you do not own. If you manage many rooms, export the list of projector addresses from your DHCP server and compare it with the model list so you do not miss units.
- Record the firmware version shown in the projector menu and keep it with the asset record, so you can compare it with whatever Sharp publishes later.
What to do now
- Identify every Sharp projector in the advisory list, including ceiling mounted units in meeting rooms and training spaces that nobody thinks of as computers.
- Apply the vendor workaround: use the product only in a safe intranet protected by a firewall, and do not connect it to the internet. Remove any port forward or public address that points at a projector.
- Move projectors to their own network segment or VLAN, and allow only the presentation and management hosts that need them.
- Watch the Sharp advisory for firmware and update when it appears. Review the release notes first and keep a rollback plan for rooms in daily use.
- Add projectors and other network displays to your asset inventory so the next advisory is a five minute lookup.
Why it matters
Two overflow CVEs with identical wording in one advisory suggest more than one unsafe memory operation in the same firmware. When you track remediation, track both identifiers, and do not close the ticket on one.
The class of weakness is memory corruption in code that copies external input into a fixed size stack buffer without checking length. Those flaws are the classic route to remote code execution on embedded devices, and the CVSS vector reflects that with high impact in all three areas and no privileges required.
There is no KEV listing and no report of exploitation in the advisory. What exists is a critical score, a network attack vector and a device category that tends to run old firmware for years. That is enough reason to take the devices off any path from the internet and to plan firmware updates as part of normal room maintenance once Sharp ships them.
Quick check
How is CVE-2025-11542 different from CVE-2025-11541?
The record uses the same description for both. They are separate identifiers for stack based buffer overflows in the same projector family, so track and verify them separately.
What is the vendor workaround?
Sharp says to use the product only in a safe intranet protected by a firewall and not to connect it to the internet.
Sources
- Sharp Display Solutions advisory, Multiple vulnerabilities in projectors
- CVE record and CVSS vector for CVE-2025-11542, published 2025-12-22
Last reviewed: 19 October 2026.
