CVE-2025-49797: Brother Driver Installer Privilege Escalation

CVE-2025-49797 Overview

CVE-2025-49797 is a local privilege escalation vulnerability affecting multiple Brother driver installers for Windows. The flaw allows a local attacker with limited privileges to execute an arbitrary program with administrative rights during the driver installation process. The issue is classified under [CWE-552: Files or Directories Accessible to External Parties], indicating that the installers expose resources loaded at elevated privilege to lower-privileged users. The advisory also covers OEM-branded installers distributed by Ricoh and Toshiba Tec, which reuse the affected Brother installer components.

Critical Impact
A local, authenticated attacker can escalate from a standard Windows user account to administrative privileges by influencing files or resources consumed by the Brother driver installer.

Affected Products

Brother driver installers for Windows (multiple models — refer to the Brother Security Support Page for exact model numbers and versions)
Ricoh printer driver installers derived from Brother components (see Ricoh Vulnerability Report ricoh-2025-000009)
Toshiba Tec printer driver installers derived from Brother components (see Toshiba Tec Security Information Update)

Discovery Timeline

2025-06-25 - CVE-2025-49797 published to NVD and coordinated advisory released via JVN Security Advisory JVNVU91819309
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49797

Vulnerability Analysis

The vulnerability resides in how multiple Brother driver installers handle files or directories used during installation on Windows. Because the installer executes with elevated privileges, any resource it loads from a location writable by a standard user becomes an execution primitive. An attacker who plants a malicious payload in that location can have it executed under the installer's administrative context. The result is arbitrary program execution with SYSTEM or Administrator privileges from a local, low-privileged starting point.

Because Brother licenses driver components to other vendors, the same installer flaw propagates into Ricoh and Toshiba Tec printer driver packages. Organizations running multi-vendor print fleets may be exposed even if they do not use Brother hardware directly.

Root Cause

The root cause maps to [CWE-552], where files or directories consumed by a privileged installer are accessible to external parties. Typical patterns behind this class of issue include insecure permissions on temporary directories, loading executables or libraries from user-writable paths, and failing to validate the integrity of resources before invocation.

Attack Vector

Exploitation requires local access and low-level privileges (PR:L) on the target Windows host, but no user interaction beyond the standard installer flow. The attacker stages a malicious binary or resource in a location the installer reads during execution. When the installer runs, or is triggered by an administrator, the planted payload is executed with administrative privileges, breaking the confidentiality, integrity, and availability of the local system.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the JVN advisory for coordinated technical details.

Detection Methods for CVE-2025-49797

Indicators of Compromise

Creation of executable files (.exe, .dll, .msi) in user-writable directories immediately before a Brother, Ricoh, or Toshiba Tec printer driver installer is executed.
Child processes spawned by the Brother/Ricoh/Toshiba Tec installer that do not match the vendor's expected process tree, particularly cmd.exe, powershell.exe, or unsigned binaries.
New local administrator accounts or scheduled tasks created within minutes of a driver installation event.

Detection Strategies

Monitor process creation events (Windows Event ID 4688 and Sysmon Event ID 1) for elevated child processes descending from printer driver installer executables.
Alert on file-write events (Sysmon Event ID 11) that place executable content into paths later read by installers running as SYSTEM.
Correlate driver installation activity with unexpected privilege changes, such as membership additions to the local Administrators group.

Monitoring Recommendations

Inventory endpoints that have Brother, Ricoh, or Toshiba Tec printer drivers installed and track their installer versions against vendor advisories.
Enable command-line auditing and PowerShell script block logging on workstations that regularly install or update printer drivers.
Forward endpoint telemetry to a centralized analytics platform so installer-related process trees can be reviewed across the fleet.

How to Mitigate CVE-2025-49797

Immediate Actions Required

Identify all Windows endpoints running Brother, Ricoh, or Toshiba Tec printer driver installers and cross-check versions against the affected lists on each vendor's advisory page.
Apply the fixed installer versions published on the Brother Security Support Page, Ricoh Vulnerability Report ricoh-2025-000009, and Toshiba Tec Security Information Update.
Restrict local logon on shared or kiosk systems where untrusted users could stage files before an administrator runs the installer.

Patch Information

Brother, Ricoh, and Toshiba Tec have released updated driver installers that address CVE-2025-49797. Because affected model numbers and versions vary across products, administrators should consult the vendor references listed in the JVN Security Advisory JVNVU91819309 to identify the correct fixed build for each device.

Workarounds

Download driver installers only from official vendor sites and execute them from directories not writable by standard users, such as a protected administrator profile.
Enforce Windows Defender Application Control or AppLocker policies that block execution of unsigned binaries from user-writable paths.
Where feasible, deploy printer drivers through managed software distribution channels that stage installers in a controlled, integrity-verified location.