Read the docs
TI-2025-00956 Aliases CVE-2025-1126GHSA-4fv3-v4jw-2q2p

Lexmark has identified a vulnerability in our Lexmark Print Management Client (LPMC).

Priority MEDIUM 42CWE-807Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Fix Fixed Lexmark Print Management Client (Lexmark): 3.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LexmarkLexmark Print Management Client3.0.0 to before 3.5.03.5.0Patch availableCNA
  • Lexmark Print Management Client VendorLexmark Affected 3.0.0 to before 3.5.0 Fixed in 3.5.0 Patch available CNA

Remediation

  • Fix · CNA Lexmark Print Management Client (Lexmark) Fixed in 3.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1126
  2. 2026-10-03 Alias added: GHSA-4fv3-v4jw-2q2p

References

Other 1

  • TI-2014-07170 Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark… CVSS 3.1CRITICAL 9.8
  • TI-2023-09391 In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. CVSS 3.1CRITICAL 9.8
  • TI-2023-11301 Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2023-11300 Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). CVSS 3.1HIGH 8.1
  • TI-2023-09090 Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. CVSS 3.1HIGH 7.5
  • TI-2021-20249 Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. CVSS 3.1CRITICAL 9.8
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences