CVE-2025-65080: Lexmark Postscript Interpreter RCE Flaw

CVE-2025-65080 Overview

A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user. Type confusion vulnerabilities occur when code processes data using an incompatible type, leading to unexpected behavior that can be exploited for malicious purposes.

Critical Impact

Network-accessible Lexmark devices with vulnerable Postscript interpreters may allow remote attackers to achieve arbitrary code execution without authentication, potentially compromising device integrity and network security.

Affected Products

• Various Lexmark printer devices with vulnerable Postscript interpreter
• Lexmark multifunction devices supporting Postscript processing
• Lexmark enterprise print infrastructure components

Discovery Timeline

• 2026-02-03 - CVE-2025-65080 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-65080

Vulnerability Analysis

This vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type), commonly known as Type Confusion. In the context of the Lexmark Postscript interpreter, the vulnerability arises when the interpreter incorrectly handles object types during Postscript document processing. When a malformed Postscript file is processed, the interpreter may treat one type of object as another, leading to memory corruption conditions that can be exploited.

The network-accessible nature of this vulnerability means attackers can potentially exploit it remotely by sending specially crafted Postscript documents to vulnerable Lexmark devices. The vulnerability allows code execution in the context of an unprivileged user, which may serve as an initial foothold for further privilege escalation or lateral movement within a network.

Root Cause

The root cause lies in improper type checking within the Lexmark Postscript interpreter. When processing Postscript language constructs, the interpreter fails to properly validate object types before performing operations on them. This allows an attacker to craft malicious Postscript content that tricks the interpreter into treating memory regions as different data types than they actually are, leading to controllable memory corruption.

Type confusion vulnerabilities in interpreters typically occur when:

• Dynamic typing systems fail to enforce type boundaries
• Object references are cast without proper validation
• Internal data structures are accessed with incorrect type assumptions

Attack Vector

The attack vector for this vulnerability is network-based, requiring no prior authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending a specially crafted Postscript document to a vulnerable Lexmark device via network printing protocols
2. The malicious document triggers the type confusion condition in the Postscript interpreter
3. Successful exploitation results in arbitrary code execution on the target device

The vulnerability does not require any privileges or user interaction, making it particularly dangerous for internet-exposed or poorly segmented network environments where Lexmark devices are accessible.

Detection Methods for CVE-2025-65080

Indicators of Compromise

• Unusual Postscript job submissions to Lexmark devices from unexpected network sources
• Abnormal memory consumption or crashes on Lexmark printer devices during print processing
• Unexpected outbound network connections from printer devices
• Suspicious process activity or file system changes on affected devices

Detection Strategies

• Monitor network traffic for anomalous Postscript document transmissions to Lexmark printers
• Implement network segmentation to isolate print infrastructure and enable visibility into device communications
• Deploy intrusion detection signatures targeting malformed Postscript content
• Review print server and device logs for failed or suspicious print jobs

Monitoring Recommendations

• Enable comprehensive logging on print servers and Lexmark device management infrastructure
• Implement network flow monitoring for printer VLANs to detect unusual communication patterns
• Configure alerts for Lexmark device reboots or service restarts that may indicate exploitation attempts
• Regularly audit device firmware versions against known vulnerable releases

How to Mitigate CVE-2025-65080

Immediate Actions Required

• Review the Lexmark Security Advisory for specific affected models and firmware versions
• Inventory all Lexmark devices in your environment and identify those with vulnerable Postscript interpreters
• Restrict network access to Lexmark devices using firewall rules and network segmentation
• Disable Postscript processing if not required for business operations

Patch Information

Lexmark has released security advisories addressing this vulnerability. Administrators should consult the official Lexmark Security Advisory page to identify affected device models and obtain the appropriate firmware updates. Apply firmware updates following your organization's change management procedures, prioritizing internet-exposed and high-value target devices.

Workarounds

• Implement network access controls to restrict Postscript job submissions to trusted sources only
• Place Lexmark devices on isolated network segments with strict ingress/egress filtering
• Disable remote printing capabilities for devices that do not require network printing functionality
• Configure print servers to pre-filter and validate Postscript documents before forwarding to devices

# Example firewall rule to restrict printer access (adjust for your environment)
# Block direct network access to printers from untrusted networks
iptables -A INPUT -p tcp --dport 9100 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9100 -j DROP
iptables -A INPUT -p tcp --dport 515 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 515 -j DROP