CVE-2025-1268 Memory corruption in CARPS2 Printer Driver
Out-of-bounds write in Canon printer drivers allows attackers to execute arbitrary code via malicious EMF files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1268?
CVE-2025-1268 is a critical memory corruption vulnerability in Canon Inc. CARPS2 Printer Driver, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver
Weakness: CWE-787
Which versions are affected by CVE-2025-1268?
How do I fix CVE-2025-1268?
No fix has been published for CVE-2025-1268 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-1268 being exploited?
There is no known exploitation of CVE-2025-1268 in the wild and no public exploit code.
Sources
Also known as GHSA-r2rc-9fhh-m65x.