CVE-2025-65081: Lexmark Postscript RCE Vulnerability

CVE-2025-65081 Overview

An out-of-bounds read vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user. The flaw is classified under CWE-125 (Out-of-bounds Read), indicating that the software reads data past the end or before the beginning of an intended buffer.

Critical Impact

Attackers exploiting this vulnerability can achieve arbitrary code execution on vulnerable Lexmark devices via the Postscript interpreter, potentially compromising print infrastructure and enabling lateral movement within corporate networks.

Affected Products

• Various Lexmark printer devices with vulnerable Postscript interpreter
• Lexmark multifunction devices supporting Postscript processing
• Refer to Lexmark Security Advisories for complete device list

Discovery Timeline

• 2026-02-03 - CVE-2025-65081 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-65081

Vulnerability Analysis

This vulnerability affects the Postscript interpreter component within Lexmark printing devices. The out-of-bounds read condition occurs when the interpreter processes specially crafted Postscript data, allowing memory outside the intended buffer boundaries to be accessed. While out-of-bounds read vulnerabilities typically lead to information disclosure, in this case the flaw can be chained or leveraged to achieve arbitrary code execution with unprivileged user permissions.

The network-accessible nature of this vulnerability means that attackers can potentially exploit it remotely by sending malicious print jobs containing crafted Postscript content to vulnerable devices. The attack requires no authentication or user interaction, making it particularly concerning for organizations with exposed print infrastructure.

Root Cause

The root cause stems from insufficient boundary validation in the Postscript interpreter when processing input data. The interpreter fails to properly verify that array indices or pointer offsets remain within allocated buffer boundaries before performing read operations. This allows an attacker to craft Postscript commands that cause the interpreter to read memory locations outside the intended data structures, ultimately leading to code execution.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can target this vulnerability by:

1. Sending a specially crafted Postscript document to a vulnerable Lexmark device via a print job
2. The malicious Postscript content triggers the out-of-bounds read condition in the interpreter
3. By carefully controlling the out-of-bounds read, the attacker can potentially leak memory contents or corrupt adjacent memory structures
4. This memory corruption can be leveraged to redirect execution flow and achieve arbitrary code execution

The attack can be delivered through various print protocols commonly exposed on enterprise networks, including IPP, LPR, or raw TCP printing on port 9100.

Detection Methods for CVE-2025-65081

Indicators of Compromise

• Unusual or malformed Postscript jobs submitted to Lexmark print queues
• Abnormal memory consumption or crashes in the Postscript interpreter process
• Unexpected network connections originating from Lexmark devices
• Print job logs showing repeated failed or unusual print requests

Detection Strategies

• Monitor print server and device logs for anomalous Postscript processing errors
• Implement network segmentation to detect unauthorized access attempts to print infrastructure
• Deploy network intrusion detection signatures for malformed Postscript content
• Review print job queues for suspicious file submissions from unknown sources

Monitoring Recommendations

• Enable detailed logging on Lexmark devices to capture Postscript processing events
• Monitor network traffic to print devices for unusual patterns or volumes
• Implement alerting for device crashes or unexpected restarts
• Track firmware versions across Lexmark device fleet to identify unpatched systems

How to Mitigate CVE-2025-65081

Immediate Actions Required

• Review the Lexmark Security Advisories for affected device models and available patches
• Restrict network access to Lexmark devices using firewall rules or network segmentation
• Disable direct internet exposure of print devices immediately
• Audit current firmware versions across all Lexmark devices in the environment

Patch Information

Lexmark has published security advisories addressing this vulnerability. Organizations should consult the official Lexmark Security Advisories page for specific firmware updates and patching instructions for affected device models. Apply firmware updates as soon as they become available through official Lexmark channels.

Workarounds

• Implement network segmentation to isolate print devices from untrusted network segments
• Disable Postscript processing if not required for business operations
• Configure access control lists to restrict which hosts can submit print jobs
• Use print management solutions that can filter or sanitize incoming print jobs before delivery to devices

# Example network segmentation for print infrastructure
# Restrict access to print devices on VLAN 100 from workstations only
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.100.0/24 -p tcp --dport 9100 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.100.0/24 -p tcp --dport 631 -j ACCEPT
iptables -A FORWARD -d 192.168.100.0/24 -j DROP