CVE-2025-9904

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-696

Affected software

VendorProductVersions
Canon Inc.Generic Plus PCL6 Printer Driver3.30 and earlier
Canon Inc.Generic Plus UFR II Printer Driver3.30 and earlier
Canon Inc.Generic Plus LIPS4 Printer Driver3.30 and earlier
Canon Inc.Generic Plus LIPSLX Printer Driver3.30 and earlier
Canon Inc.Generic Plus PS Printer Driver3.30 and earlier
Canon Inc.UFRII LT Printer Driver31.05 and earlier
Canon Inc.CARPS2 Printer Driver31.05 and earlier
Canon Inc.Generic FAX Driver10.67 and earlier
Canon Inc.LIPS4 Printer Driver15.00 and earlier
Canon Inc.LIPSLX Printer Driver15.00 and earlier
Canon Inc.UFR II Printer Driver15.00 and earlier
Canon Inc.PS Printer Driver15.00 and earlier
Canon Inc.PCL6 Printer Driver15.00 and earlier

References

Timeline

Published
Sep 29, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-99057.3The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a speciallCVE-2025-99067.3The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a speciallCVE-2025-99076.7A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposureCVE-2025-99086.7A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authentiCVE-2025-99096.7A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft viaCVE-2025-99104.7Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker caCVE-2025-99126.3Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an autheCVE-2025-99136.1JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijackCVE-2025-99147.5The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unCVE-2025-99188.7A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior CVE-2025-99199.8A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdCVE-2025-99207.2A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/ind
CVE-2025-9904: Medium severity, CVSS 5.3 | Vulnix