PT-2026-5948 · Lexmark · Lexmark Devices

Published 2026-02-03 · Updated 2026-02-12 · CVE-2025-65080

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Lexmark CX532adwe (affected versions not specified)

Description A type confusion exists within the Postscript interpreter in Lexmark devices. This issue allows an attacker to execute arbitrary code as an unprivileged user. The vulnerability was discovered during the Pwn2Own competition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2025-65080

ZDI-26-065

Affected Products

Lexmark Devices

References · 5

• https://zerodayinitiative.com/advisories/ZDI-26-065 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65080 · Security Note
• https://lexmark.com/en_us/solutions/security/lexmark-security-advisories.html · Note
• https://twitter.com/CVEnew/status/2018790667556999575 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2022053463404822989 · Twitter Post