CVE-2025-9903: Canon Printer Driver Buffer Overflow Flaw

CVE-2025-9903 Overview

CVE-2025-9903 is an out-of-bounds write vulnerability [CWE-787] affecting print processing in multiple Canon printer drivers. Impacted drivers include Generic Plus PCL6, Generic Plus UFR II, Generic Plus LIPS4, Generic Plus LIPSLX, Generic Plus PS, UFRII LT, CARPS2, Generic FAX, LIPS4, LIPSLX, UFR II, PS, and PCL6. The flaw resides in code paths that handle print job data, where malformed input can trigger a memory write outside the allocated buffer. Canon disclosed the issue in advisory CP2025-005. Exploitation requires user interaction and high attack complexity, but successful abuse can compromise integrity on the affected system.

Critical Impact
An attacker who convinces a user to process a crafted print job can trigger an out-of-bounds write in the driver, enabling integrity impact and potential code execution in the print processing context.

Affected Products

Canon Generic Plus PCL6, UFR II, LIPS4, LIPSLX, and PS Printer Drivers
Canon UFRII LT, CARPS2, and Generic FAX Drivers
Canon LIPS4, LIPSLX, UFR II, PS, and PCL6 Printer Drivers

Discovery Timeline

2025-09-29 - CVE-2025-9903 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9903

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds write [CWE-787] occurring during print job processing inside the affected Canon driver modules. When the driver parses print data structures, insufficient boundary checks allow a write operation to cross the end of an allocated buffer. This corrupts adjacent memory regions used by the driver process. Because print drivers commonly execute with elevated privileges through the Windows print spooler, memory corruption in these components can influence integrity of privileged operations. The Canon PSIRT advisory CP2025-005 documents the issue across the Generic Plus family and multiple model-specific drivers.

Root Cause

The root cause is missing or inadequate size validation in a print data parsing routine. The driver trusts length or offset fields supplied through the print job pipeline and writes payload bytes without confirming they fit inside the destination buffer. This pattern is characteristic of CWE-787 defects in binary format handlers.

Attack Vector

Exploitation is network-adjacent from a scoring perspective but requires user interaction, such as an operator submitting or opening a crafted print job that reaches the vulnerable driver. High attack complexity indicates non-trivial conditions must be met to reliably trigger the write. A successful attack impacts integrity and, to a lesser extent, availability of the print processing component. No public proof-of-concept exploit is currently listed, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog.

Because no verified proof-of-concept code has been published, exploitation specifics are described in prose. Refer to the Canon PSIRT Advisory CP2025-005 for authoritative technical guidance.

Detection Methods for CVE-2025-9903

Indicators of Compromise

Unexpected crashes, hangs, or restarts of the Windows print spooler service (spoolsv.exe) on hosts using affected Canon drivers.
Windows Error Reporting entries referencing Canon driver modules such as those associated with Generic Plus PCL6, UFR II, LIPS4, LIPSLX, or PS drivers.
Anomalous child processes spawned from spoolsv.exe or driver host processes after a print job is processed.

Detection Strategies

Monitor endpoint telemetry for memory access violations and exception events tied to Canon printer driver binaries.
Alert on print spooler service crashes that correlate with the arrival or processing of specific print jobs.
Inspect installed driver versions across the fleet and flag hosts running Canon driver versions predating the CP2025-005 remediation.

Monitoring Recommendations

Enable and forward Microsoft-Windows-PrintService/Operational and Admin event logs to a central logging platform.
Track process creation and module load events for spoolsv.exe and Canon driver DLLs to establish a behavioral baseline.
Review print server activity for unusual submission patterns, especially jobs originating from unauthenticated or unexpected sources.

How to Mitigate CVE-2025-9903

Immediate Actions Required

Inventory all endpoints and print servers running Canon Generic Plus, UFRII LT, CARPS2, Generic FAX, LIPS4, LIPSLX, UFR II, PS, or PCL6 drivers.
Apply the updated driver versions provided by Canon in advisory CP2025-005 as soon as they are validated for your environment.
Restrict print job submission to authenticated internal users and block direct print protocol access from untrusted networks.

Patch Information

Canon has published remediation guidance and updated driver packages. Consult the Canon CP2025-005 Remediation Guide, the Canon PSIRT Advisory CP2025-005, and the Canon Vulnerability Response page to identify the fixed driver version for each affected model and deploy through standard driver management tooling.

Workarounds

Limit which users and hosts can submit jobs to print servers hosting the affected drivers until patches are deployed.
Segment print servers on dedicated VLANs and restrict inbound access to required print protocols only.
Where feasible, temporarily switch to an unaffected driver or a class driver for critical workflows while remediation is in progress.

bash

# Example: enumerate installed Canon printer drivers on a Windows host
Get-PrinterDriver | Where-Object { $_.Manufacturer -like 'Canon*' } |
    Select-Object Name, DriverVersion, InfPath