CVE-2025-65080

Vulnerability

Details

CVE-2025-65080 is a type confusion vulnerability found in the PostScript interpreter of various Lexmark printers and multifunction devices. This programming error occurs when the interpreter incorrectly handles object types during PostScript processing, leading to memory corruption that can be leveraged for arbitrary code execution. The flaw resides in the interpreter's internal type-checking logic, which fails to properly validate object type identifiers before performing operations on them [1].

Exploitation

Vector

An attacker can exploit this vulnerability by sending a specially crafted PostScript file to the device's print or processing service. No authentication is required, as the PostScript interpreter typically accepts jobs from any network client by default in many configurations. The attack can be delivered over the network via standard printing protocols (e.g., LPD, IPP) or via the embedded web server's print submission interface. Successful exploitation does not require any prior knowledge of the device beyond its network address [1].

Impact

If exploited, the vulnerability allows an attacker to execute arbitrary code in the context of an unprivileged user. While this limits direct access to system-level functions, the attacker can still potentially modify print jobs, access network file shares accessible to the device, or use the device as a foothold for lateral movement within the organization. Lexmark rates the severity as Medium (CVSS base score assigned internally) [1].

Remediation

Lexmark has released firmware updates that address this vulnerability in its security advisories portal. Administrators should apply the latest firmware for affected models immediately. As a workaround, restricting network access to the device's printing services via firewall rules or disabling PostScript support if not required can reduce exposure. No evidence of active exploitation has been reported at the time of publication, but public disclosure increases the likelihood of attacker interest [1].