ZDI-26-064: (Pwn2Own) Lexmark CX532adwe execuserobject Heap-based Buffer Overflow Remote Code Execution Vulnerability
Published Feb 5, 2026
·Updated
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65081.
Affected Software
1 affected component
Lexmark CX532adwe
Event History
Feb 5, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-26-064?
The severity of ZDI-26-064 is classified as critical due to its potential for remote code execution.
2
How do I fix ZDI-26-064?
To fix ZDI-26-064, apply the latest firmware updates provided by Lexmark for the CX532adwe printer.
3
Who is affected by ZDI-26-064?
ZDI-26-064 affects installations of Lexmark CX532adwe printers that are network-adjacent.
4
Can ZDI-26-064 be exploited without authentication?
Yes, ZDI-26-064 can be exploited without any authentication requirements.
5
What type of vulnerability is ZDI-26-064?
ZDI-26-064 is a heap-based buffer overflow vulnerability that allows remote code execution.