CVE-2025-4044

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
LexmarkUniversal Print Driver< 3.0.6.0
LexmarkPrinter Software G2< 2.17.0.0

References

Timeline

Published
Aug 19, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40468.5A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organizatioCVE-2025-40474.3The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_stCVE-2025-40498.6Use of hard-coded, the same among all vulnerable installations SQLite credentials vulnerability in SIGNUM-NET FARA allows to read and manipuCVE-2025-40508.8Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in CVE-2025-40516.3Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage inCVE-2025-40529.8Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage inCVE-2025-40536.8The data stored in Be-Tech Mifare Classic card is stored in cleartext. An attacker having access to a Be-Tech hotel guest Mifare Classic carCVE-2025-405369.8SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthentiCVE-2025-405377.5SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow acCVE-2025-405387.2A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin usCVE-2025-405397.2A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code aCVE-2025-40546.1The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all v
CVE-2025-4044: High severity, CVSS 8.2 | Vulnix