CVE-2025-48499: FUJIFILM MFP Out-of-Bounds Write DoS Flaw

CVE-2025-48499 Overview

CVE-2025-48499 is an out-of-bounds write vulnerability [CWE-787] affecting FUJIFILM Business Innovation multifunction printers (MFPs). A remote attacker can send a specially crafted Internet Printing Protocol (IPP) or Line Printer Daemon (LPD) packet to trigger a denial-of-service (DoS) condition on the target device. Recovery from the DoS state requires a manual reset of the MFP.

The vulnerability requires no authentication and no user interaction. It is exploitable across the network on any MFP exposing IPP or LPD services. See the JVN Security Advisory and the Fujifilm Security Notice for vendor guidance.

Critical Impact
Unauthenticated remote attackers can crash affected FUJIFILM MFPs through a single malformed print protocol packet, disrupting printing services until the device is manually reset.

Affected Products

FUJIFILM Business Innovation MFPs supporting IPP
FUJIFILM Business Innovation MFPs supporting LPD
Refer to the Fujifilm Security Notice for the exhaustive model list

Discovery Timeline

2025-08-04 - CVE-2025-48499 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48499

Vulnerability Analysis

The flaw is an out-of-bounds write [CWE-787] in the network print service handling logic of affected FUJIFILM Business Innovation MFPs. When the firmware parses an incoming IPP or LPD packet, it writes data past the bounds of an intended buffer. The corrupted memory state destabilizes the print service and forces the device into an unrecoverable error condition.

Because the affected code path is reachable through TCP ports 631 (IPP) and 515 (LPD), any host that can route packets to the MFP can trigger the condition. No credentials or user interaction are required. The impact is limited to availability — confidentiality and integrity are not affected — but recovery mandates a physical or administrative reset of the device.

Root Cause

The root cause is insufficient bounds checking during deserialization of attacker-controlled fields inside IPP or LPD packets. Fields exceeding the expected size are written into a fixed-size buffer, overwriting adjacent memory used by the print daemon. The resulting memory corruption crashes the service and halts print processing.

Attack Vector

An attacker sends a single malformed IPP or LPD packet to the MFP over the local network or, where the device is exposed, over the internet. The exploit does not require authentication, session establishment, or prior reconnaissance beyond identifying an open print service port.

No public proof-of-concept code has been released. The vulnerability is described in prose only in the vendor advisories; consult the JVN Security Advisory for technical detail.

Detection Methods for CVE-2025-48499

Indicators of Compromise

Unexpected reboots or hangs of FUJIFILM MFPs coinciding with inbound traffic to TCP port 631 or 515
Print service outages requiring manual power cycling of the device
Malformed IPP or LPD packets with oversized attribute fields captured in network telemetry
Loss of SNMP heartbeat from managed MFPs following unusual print protocol traffic

Detection Strategies

Monitor TCP 631 (IPP) and TCP 515 (LPD) sessions for oversized payloads or non-conforming protocol structures
Deploy network intrusion detection signatures that validate IPP attribute lengths against RFC 8010 boundaries
Correlate MFP availability alerts with preceding inbound print protocol traffic from unusual sources
Enable syslog forwarding from MFPs to a centralized log platform and alert on service crash events

Monitoring Recommendations

Ingest MFP syslog and SNMP trap data into a centralized SIEM for correlation with network flow records
Alert on repeated print service restarts across the MFP fleet within short time windows
Track source IPs sending malformed print protocol traffic and baseline expected print client behavior

How to Mitigate CVE-2025-48499

Immediate Actions Required

Restrict inbound access to TCP 631 and TCP 515 on all FUJIFILM MFPs to authorized print servers and workstations only
Remove any internet exposure of MFP print services by blocking the affected ports at the perimeter firewall
Apply firmware updates published by FUJIFILM as listed in the Fujifilm Security Notice
Inventory all FUJIFILM Business Innovation MFPs and confirm firmware versions against the vendor advisory

Patch Information

FUJIFILM Business Innovation has published remediation guidance and firmware updates in the Fujifilm Security Notice. Administrators should identify affected models within their environment and apply the corresponding firmware release. Coordinate updates through vendor support channels where required, as MFP firmware deployment often depends on model-specific procedures.

Workarounds

Disable IPP and LPD services on MFPs where they are not required for business operations
Place MFPs on a dedicated network segment or VLAN isolated from untrusted hosts
Enforce ACLs on network switches to permit print protocol traffic only from designated print servers
Deploy a print server as an intermediary so that clients never communicate directly with MFPs over IPP or LPD

bash

# Example: restrict IPP and LPD access using iptables on an upstream gateway
iptables -A FORWARD -p tcp --dport 631 -s 10.10.20.0/24 -d 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 515 -s 10.10.20.0/24 -d 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 631 -d 10.10.50.0/24 -j DROP
iptables -A FORWARD -p tcp --dport 515 -d 10.10.50.0/24 -j DROP