CVE-2025-4044: Lexmark Printer Drivers XXE Vulnerability

CVE-2025-4044 Overview

CVE-2025-4044 is an XML External Entity (XXE) vulnerability affecting multiple Lexmark printer drivers for Windows. The flaw resides in improper restriction of XML external entity references during driver-side XML parsing. An authenticated local attacker can craft a malicious XML document that forces the driver to resolve external entities, causing the process to disclose local file contents or send sensitive data to an attacker-controlled URL. The issue is tracked under CWE-611: Improper Restriction of XML External Entity Reference and requires user interaction to trigger. Successful exploitation crosses a security scope boundary and impacts confidentiality, integrity, and availability of the host.

Critical Impact
An authenticated local attacker can weaponize the vulnerable Lexmark Windows printer driver to exfiltrate sensitive files and internal data to an arbitrary URL controlled by the attacker.

Affected Products

Various Lexmark printer drivers for Windows (specific driver versions listed in the Lexmark Security Advisories)
Windows endpoints and print servers running the affected Lexmark drivers
Multi-user Windows systems where standard users can invoke driver XML parsing paths

Discovery Timeline

2025-08-19 - CVE-2025-4044 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4044

Vulnerability Analysis

The vulnerability originates in the XML parser used by affected Lexmark Windows printer drivers. The parser processes XML input without disabling external entity resolution or Document Type Definition (DTD) processing. When a driver component parses attacker-supplied XML, embedded external entity references are dereferenced by the parser.

This behavior enables classic XXE exploitation patterns: reading local files through the file:// protocol handler, and out-of-band data exfiltration through HTTP or other supported URL schemes. Because the driver runs with elevated privileges during certain print pipeline operations, exfiltrated content can include files not normally readable by the invoking user, and the scope of the attack extends beyond the attacker's original privilege boundary.

Root Cause

The root cause is missing hardening on the driver's XML parser configuration. External entity resolution and DTD processing remain enabled by default, and the parser does not validate or restrict the URIs referenced by external entities. This is a common instance of [CWE-611] where the parser trusts document-supplied entity declarations.

Attack Vector

Exploitation requires local access and low privileges, combined with user interaction. An attacker places a malicious XML file, print job, or configuration document where the vulnerable driver will parse it. When a user triggers the print or driver workflow, the parser resolves an attacker-controlled SYSTEM entity, causing the driver to fetch content from a file:// path and transmit it to an HTTP endpoint defined by the attacker.

No verified public proof-of-concept code is available for CVE-2025-4044. Refer to the Lexmark Security Advisories for vendor-supplied technical detail.

Detection Methods for CVE-2025-4044

Indicators of Compromise

Outbound HTTP or HTTPS connections initiated by Lexmark driver processes to unexpected external hosts
Unusual file:// or http:// URI patterns present in XML documents opened by driver components
Access events on sensitive files such as C:\Windows\win.ini or credential stores immediately followed by network egress from a printer driver process

Detection Strategies

Monitor endpoints for printer driver executables spawning network activity outside of normal update or telemetry destinations
Inspect process ancestry and command lines involving Lexmark driver components parsing XML from user-writable paths
Alert on XML documents in spool or configuration directories that contain <!DOCTYPE declarations or SYSTEM entity references

Monitoring Recommendations

Enable process and network telemetry from Windows print servers and endpoints with Lexmark drivers installed
Baseline normal driver network destinations and alert on deviations
Correlate file-read events on sensitive paths with subsequent outbound connections from the same driver process

How to Mitigate CVE-2025-4044

Immediate Actions Required

Inventory all Windows endpoints and print servers running Lexmark printer drivers and identify affected versions
Apply the vendor-supplied driver update referenced in the Lexmark Security Advisories
Restrict standard user ability to install or reconfigure printer drivers on shared Windows systems
Block outbound network access from printer driver processes at the host firewall where feasible

Patch Information

Lexmark has published fixed driver versions through the Lexmark Security Advisories portal. Administrators should download the updated Windows driver package for each affected printer model and deploy through standard driver distribution channels such as Group Policy, Microsoft Endpoint Configuration Manager, or Intune.

Workarounds

Remove unused Lexmark drivers from Windows endpoints and print servers until patches can be deployed
Apply egress network filtering to prevent driver processes from reaching arbitrary internet destinations
Restrict write access to spool and driver configuration directories so untrusted users cannot stage malicious XML documents

bash

# Example: block outbound traffic from a Lexmark driver process using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Lexmark Driver Egress" `
  -Direction Outbound `
  -Program "C:\Windows\System32\spool\drivers\\x64\3\LexmarkDriver.exe" `
  -Action Block