ZDI-26-066: (Pwn2Own) Lexmark CX532adwe getCFFNames Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65079.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-066?
The severity of ZDI-26-066 is high due to its potential for remote code execution.
How do I fix ZDI-26-066?
To fix ZDI-26-066, update the firmware of the Lexmark CX532adwe printer to the latest version provided by the manufacturer.
Who is affected by ZDI-26-066?
ZDI-26-066 affects Lexmark CX532adwe printers that are accessible over the network.
Is authentication required to exploit ZDI-26-066?
No, authentication is not required to exploit ZDI-26-066, making it particularly critical.
What type of vulnerability is ZDI-26-066?
ZDI-26-066 is a heap-based buffer overflow vulnerability that allows for arbitrary code execution.