Incorrect behavior order in Canon Inc. products - CVE-2025-9904
Published: September 30, 2025
Vulnerability identifier: #VU116181
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2025-9904
CWE-ID: CWE-696
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Canon Inc.
Affected software:
Generic Plus PCL6 Printer Driver
Generic Plus UFR II Printer Driver
Generic Plus LIPS4 Printer Driver
Generic Plus LIPSLX Printer Driver
Generic Plus PS Printer Driver
Generic Plus PCL6 Printer Driver
Generic Plus UFR II Printer Driver
Generic Plus LIPS4 Printer Driver
Generic Plus LIPSLX Printer Driver
Generic Plus PS Printer Driver
Detailed vulnerability description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to unallocated memory access in print processing. A remote attacker can perform a denial of service (DoS) attack.
How to mitigate CVE-2025-9904
Install updates from vendor's website.
Sources
- https://jvn.jp/en/vu/JVNVU93104961/index.html
- https://psirt.canon/advisory-information/cp2025-005/
- https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers
- https://www.canon-europe.com/support/product-security/