CVE-2025-9904 Memory corruption in CARPS2 Printer Driver
Attackers can exploit unallocated memory access in Canon printer drivers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9904?
CVE-2025-9904 is a medium-severity memory corruption vulnerability in Canon Inc. CARPS2 Printer Driver, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver
Weakness: CWE-696
Which versions are affected by CVE-2025-9904?
How do I fix CVE-2025-9904?
No fix has been published for CVE-2025-9904 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9904 being exploited?
There is no known exploitation of CVE-2025-9904 in the wild and no public exploit code.
Sources
Also known as GHSA-hv8v-h5q2-gmv5.