Incorrect behavior order in Canon Inc. products - CVE-2025-9904

Vulnerability identifier: #VU116181

CSH Severity: High

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-9904

CWE-ID: CWE-696

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to unallocated memory access in print processing. A remote attacker can perform a denial of service (DoS) attack.

Generic Plus PCL6 Printer Driver
Generic Plus UFR II Printer Driver
Generic Plus LIPS4 Printer Driver
Generic Plus LIPSLX Printer Driver
Generic Plus PS Printer Driver

Install updates from vendor's website.

Generic Plus PCL6 Printer Driver - update to 3.31
Generic Plus UFR II Printer Driver - update to 3.31
Generic Plus LIPS4 Printer Driver - update to 3.31
Generic Plus LIPSLX Printer Driver - update to 3.31
Generic Plus PS Printer Driver - update to 3.31

• https://jvn.jp/en/vu/JVNVU93104961/index.html
• https://psirt.canon/advisory-information/cp2025-005/
• https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers
• https://www.canon-europe.com/support/product-security/

• Multiple vulnerabilities in Canon Printer Drivers for Production Printers, Office/Small Office Multifunction Printers and Laser Printers