CVE-2025-9904: Printer Driver Use-After-Free Vulnerability

CVE-2025-9904 Overview

CVE-2025-9904 is an unallocated memory access vulnerability affecting a broad range of Canon printer drivers, including the Generic Plus PCL6, UFR II, LIPS4, LIPSLX, and PS drivers, along with UFRII LT, CARPS2, Generic FAX, and standalone LIPS4/LIPSLX/UFR II/PS/PCL6 drivers. The flaw resides in the print processing logic and is tracked under CWE-696 (Incorrect Behavior Order). An attacker able to submit a crafted print job can trigger access to memory that was never properly allocated. The impact is limited to availability, with no confidentiality or integrity effects reported.

Critical Impact
Successful exploitation can cause a denial-of-service condition against systems running the affected Canon printer drivers when they process a malformed print job.

Affected Products

Canon Generic Plus PCL6, UFR II, LIPS4, LIPSLX, and PS Printer Drivers
Canon UFRII LT, CARPS2, and Generic FAX Drivers
Canon standalone LIPS4, LIPSLX, UFR II, PS, and PCL6 Printer Drivers

Discovery Timeline

2025-09-29 - CVE-2025-9904 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-9904

Vulnerability Analysis

The vulnerability is classified under [CWE-696] as an incorrect behavior order that leads to unallocated memory access during print job processing. The affected Canon drivers dispatch operations against a memory region before that region has been properly allocated or initialized. When the driver receives specifically crafted print data, control flow reaches code paths that read from or write to invalid memory. This produces undefined behavior in the driver process, typically manifesting as a crash of the print pipeline. The attack vector is network-reachable, meaning a remote attacker who can submit print jobs to a shared printer queue can trigger the condition without authentication or user interaction.

Root Cause

The root cause is an ordering flaw in the driver's print processing routines. Memory operations execute before the allocation and initialization steps complete, leaving the driver to operate on unallocated buffers. Because the affected code path is shared across the Generic Plus and legacy Canon driver families, a single logic defect propagates across the entire product line.

Attack Vector

An unauthenticated attacker with network reachability to a host that has one of the affected Canon drivers installed can send a crafted print job. The malformed job forces the driver into the vulnerable code path, triggering the unallocated memory access. The impact is confined to availability of the print processing component; no code execution or data disclosure has been documented by the vendor.

No public proof-of-concept has been released. Refer to the Canon PSIRT Advisory CP2025-005 for vendor technical details.

Detection Methods for CVE-2025-9904

Indicators of Compromise

Repeated crashes or unexpected termination of the Canon printer driver host process or the Windows Print Spooler service (spoolsv.exe) after receiving print jobs.
Windows Application or System event log entries referencing faults in Canon driver modules (for example, CNP* or UFRII* DLLs).
Print jobs originating from unexpected internal or external sources targeting shared printer queues.

Detection Strategies

Monitor endpoints and print servers for crash telemetry associated with Canon driver binaries and correlate with recent print job submissions.
Alert on abnormal spikes in RPC print job traffic to print servers, particularly from hosts that do not normally print.
Review print server audit logs for malformed job submissions and unusual client-to-queue relationships.

Monitoring Recommendations

Enable Print Service operational logging on Windows print servers and forward events to a centralized SIEM for correlation.
Track driver and spooler process stability metrics as availability indicators for CVE-2025-9904 exploitation attempts.
Baseline expected print job sources so that unauthenticated or external submissions can be flagged for review.

How to Mitigate CVE-2025-9904

Immediate Actions Required

Inventory all Windows hosts and print servers with Canon Generic Plus or affected legacy Canon drivers installed.
Apply the updated driver versions published by Canon as soon as they are validated for your environment.
Restrict network access to print queues so that only trusted internal hosts can submit jobs.

Patch Information

Canon has published remediation guidance and updated driver packages through its regional support portals. Refer to the Canon Vulnerability Response notice, the Canon PSIRT Advisory CP2025-005, the Canon Europe Product Security page, and the Canon USA Printer Driver Remediation advisory for the fixed driver versions applicable to each product family.

Workarounds

Limit inbound access to the Windows Print Spooler by firewalling TCP ports 445 and 139 and RPC endpoints from untrusted networks.
Disable printer sharing on hosts that do not need to serve print queues, reducing the attack surface for CVE-2025-9904.
Remove unused Canon print drivers from endpoints and servers until vendor-updated versions are deployed.

bash

# Configuration example: restrict the Print Spooler on non-server Windows hosts
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify no Canon vulnerable drivers remain enumerated
Get-PrinterDriver | Where-Object { $_.Name -match 'Canon|UFR|LIPS|PCL6|CARPS2' }