CVE-2023-26066

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-10 · updated 2026-06-17
Weakness: CWE-129

Description

Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.

Affected products

Lexmark Cslbl Firmware: before cslbl.081.232 — fixed in cslbl.081.232
Lexmark Cslbn Firmware: before cslbn.081.232 — fixed in cslbn.081.232
Lexmark Csnzj Firmware: before csnzj.081.232 — fixed in csnzj.081.232
Lexmark Cstpc Firmware: before cstpc.081.232 — fixed in cstpc.081.232
Lexmark Cstzj Firmware: before cstzj.081.232 — fixed in cstzj.081.232
Lexmark Cxlbl Firmware: before cxlbl.081.232 — fixed in cxlbl.081.232
Lexmark Cxlbn Firmware: before cxlbn.081.232 — fixed in cxlbn.081.232
Lexmark Cxtmm Firmware: before cxtmm.081.232 — fixed in cxtmm.081.232
Lexmark Cxtpc Firmware: before cxtpc.081.232 — fixed in cxtpc.081.232
Lexmark Cxtzj Firmware: before cxtzj.081.232 — fixed in cxtzj.081.232
Lexmark Lhs60 Firmware: before lhs60.cm2.p760; before lhs60.cm4.p760; before lhs60.hc.p760; before lhs60.hv.p760; before lhs60.tp.p760; before lhs60.vk.p760 — fixed in lhs60.cm2.p760, lhs60.cm4.p760, lhs60.hc.p760, lhs60.hk.p760, lhs60.hv.p760, lhs60.jr.p760
Lexmark Lp Firmware: before lp.jb.p837; before lp.sp.p837 — fixed in lp.jb.p837, lp.sp.p837
Lexmark Lr Firmware: before lr.sk.p838; before lr.ske.p838; before lr.lbh.p838; before lr.jp.p838; before lr.bs.p838; before lr.mn.p838 — fixed in lr.bs.p838, lr.fl.p838, lr.jp.p838, lr.lbh.p838, lr.mn.p838, lr.sk.p838
Lexmark Lw80 Firmware: before lw80.sb7.p234; before lw80.dn2.p234; before lw80.dn4.p234; before lw80.dn7.p234; before lw80.tu.p234; before lw80.sa.p234 — fixed in lw80.dn2.p234, lw80.dn4.p234, lw80.dn7.p234, lw80.gm2.p234, lw80.gm4.p234, lw80.gm7.p234
Lexmark Mslbd Firmware: before mslbd.081.232 — fixed in mslbd.081.232
Lexmark Mslsg Firmware: before mslsg.081.232 — fixed in mslsg.081.232
Lexmark Msngm Firmware: before msngm.081.232 — fixed in msngm.081.232
Lexmark Msngw Firmware: before msngw.081.232 — fixed in msngw.081.232
Lexmark Mstgw Firmware: before mstgw.081.232 — fixed in mstgw.081.232
Lexmark Mxlbd Firmware: before mxlbd.081.232 — fixed in mxlbd.081.232
Lexmark Mxlsg Firmware: before mxlsg.081.232 — fixed in mxlsg.081.232
Lexmark Mxngm Firmware: before mxngm.081.232 — fixed in mxngm.081.232
Lexmark Mxtct Firmware: before mxtct.081.232 — fixed in mxtct.081.232
Lexmark Mxtgm Firmware: before mxtgm.081.232 — fixed in mxtgm.081.232
Lexmark Mxtgw Firmware: before mxtgw.081.232 — fixed in mxtgw.081.232
Lexmark Mxtpm Firmware: before mxtpm.081.232 — fixed in mxtpm.081.232

How to fix

Upgrade to a fixed version: Lexmark Cslbl Firmware cslbl.081.232; Lexmark Cslbn Firmware cslbn.081.232; Lexmark Csnzj Firmware csnzj.081.232; Lexmark Cstpc Firmware cstpc.081.232; Lexmark Cstzj Firmware cstzj.081.232; Lexmark Cxlbl Firmware cxlbl.081.232; Lexmark Cxlbn Firmware cxlbn.081.232; Lexmark Cxtmm Firmware cxtmm.081.232; Lexmark Cxtpc Firmware cxtpc.081.232; Lexmark Cxtzj Firmware cxtzj.081.232; Lexmark Lhs60 Firmware lhs60.cm2.p760, lhs60.cm4.p760, lhs60.hc.p760, lhs60.hk.p760; Lexmark Lp Firmware lp.jb.p837, lp.sp.p837. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26066 or the next vulnerability affects your stack