Lexmark vulnerabilities
We track 12 vulnerabilities in Lexmark products across 60+ products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on February 3, 2026.
Latest Lexmark vulnerabilities
- 9.3 Critical severity
MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV…: Untrusted Search Path
An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.
- 8.8 High severity
MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV…: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user.
- 8.2 High severity
Universal Print Driver: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.
- 9.1 Critical severity
CX, XC, CS, MS, MX, XM, et. al.: Improper Limitation of a Pathname to a Restricted Directory
The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.
- 7.3 High severity
CX, XC, CS, MS, MX, XM, et. al.: Access of Resource Using Incompatible Type
A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- 8.8 High severity
Printer Firmware: Heap-based Buffer Overflow
A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- 9.1 Critical severity
The SE menu contains information used by Lexmark to diagnose device errors.
The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to execute arbitrary code.
- 9.0 Critical severity
various: Incorrect Calculation of Buffer Size
A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- 9.0 Critical severity
A heap corruption vulnerability has been identified in PostScript interpreter in various…
A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- 9.0 Critical severity
various: Stack-based Buffer Overflow
A buffer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
- 7.5 High severity
cs310: Improper Restriction of XML External Entity Reference
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware
- 8.1 High severity
Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an…
Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots.