CVE-2025-65081: Lexmark Postscript RCE Vulnerability

CVE-2025-65081 Overview

An out-of-bounds read vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user. The flaw is classified under CWE-125 (Out-of-bounds Read), indicating that the software reads data past the end or before the beginning of an intended buffer.

Critical Impact
Attackers exploiting this vulnerability can achieve arbitrary code execution on vulnerable Lexmark devices via the Postscript interpreter, potentially compromising print infrastructure and enabling lateral movement within corporate networks.

Affected Products

Various Lexmark printer devices with vulnerable Postscript interpreter
Lexmark multifunction devices supporting Postscript processing
Refer to Lexmark Security Advisories for complete device list

Discovery Timeline

2026-02-03 - CVE-2025-65081 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-65081

Vulnerability Analysis

This vulnerability affects the Postscript interpreter component within Lexmark printing devices. The out-of-bounds read condition occurs when the interpreter processes specially crafted Postscript data, allowing memory outside the intended buffer boundaries to be accessed. While out-of-bounds read vulnerabilities typically lead to information disclosure, in this case the flaw can be chained or leveraged to achieve arbitrary code execution with unprivileged user permissions.

The network-accessible nature of this vulnerability means that attackers can potentially exploit it remotely by sending malicious print jobs containing crafted Postscript content to vulnerable devices. The attack requires no authentication or user interaction, making it particularly concerning for organizations with exposed print infrastructure.

Root Cause

The root cause stems from insufficient boundary validation in the Postscript interpreter when processing input data. The interpreter fails to properly verify that array indices or pointer offsets remain within allocated buffer boundaries before performing read operations. This allows an attacker to craft Postscript commands that cause the interpreter to read memory locations outside the intended data structures, ultimately leading to code execution.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can target this vulnerability by:

Sending a specially crafted Postscript document to a vulnerable Lexmark device via a print job
The malicious Postscript content triggers the out-of-bounds read condition in the interpreter
By carefully controlling the out-of-bounds read, the attacker can potentially leak memory contents or corrupt adjacent memory structures
This memory corruption can be leveraged to redirect execution flow and achieve arbitrary code execution

The attack can be delivered through various print protocols commonly exposed on enterprise networks, including IPP, LPR, or raw TCP printing on port 9100.

Detection Methods for CVE-2025-65081

Indicators of Compromise

Unusual or malformed Postscript jobs submitted to Lexmark print queues
Abnormal memory consumption or crashes in the Postscript interpreter process
Unexpected network connections originating from Lexmark devices
Print job logs showing repeated failed or unusual print requests

Detection Strategies

Monitor print server and device logs for anomalous Postscript processing errors
Implement network segmentation to detect unauthorized access attempts to print infrastructure
Deploy network intrusion detection signatures for malformed Postscript content
Review print job queues for suspicious file submissions from unknown sources

Monitoring Recommendations

Enable detailed logging on Lexmark devices to capture Postscript processing events
Monitor network traffic to print devices for unusual patterns or volumes
Implement alerting for device crashes or unexpected restarts
Track firmware versions across Lexmark device fleet to identify unpatched systems

How to Mitigate CVE-2025-65081

Immediate Actions Required

Review the Lexmark Security Advisories for affected device models and available patches
Restrict network access to Lexmark devices using firewall rules or network segmentation
Disable direct internet exposure of print devices immediately
Audit current firmware versions across all Lexmark devices in the environment

Patch Information

Lexmark has published security advisories addressing this vulnerability. Organizations should consult the official Lexmark Security Advisories page for specific firmware updates and patching instructions for affected device models. Apply firmware updates as soon as they become available through official Lexmark channels.

Workarounds

Implement network segmentation to isolate print devices from untrusted network segments
Disable Postscript processing if not required for business operations
Configure access control lists to restrict which hosts can submit print jobs
Use print management solutions that can filter or sanitize incoming print jobs before delivery to devices

bash

# Example network segmentation for print infrastructure
# Restrict access to print devices on VLAN 100 from workstations only
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.100.0/24 -p tcp --dport 9100 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.100.0/24 -p tcp --dport 631 -j ACCEPT
iptables -A FORWARD -d 192.168.100.0/24 -j DROP