Out-of-bounds write in Canon Inc. Generic Plus PCL6 Printer Driver
Priority MEDIUM 50CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00822 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canon Inc. | Generic Plus PCL6 Printer Driver | up to 3.12 | — | No fix listed | CNA |
| Canon Inc. | Generic Plus UFR II Printer Driver | up to 3.12 | — | No fix listed | CNA |
| Canon Inc. | Generic Plus LIPS4 Printer Driver | up to 3.12 | — | No fix listed | CNA |
| Canon Inc. | Generic Plus LIPSLX Printer Driver | up to 3.12 | — | No fix listed | CNA |
| Canon Inc. | Generic Plus PS Printer Driver | up to 3.12 | — | No fix listed | CNA |
| Canon Inc. | Generic FAX Printer Driver | up to 10.65 | — | No fix listed | CNA |
| Canon Inc. | UFRII LT Printer Driver | up to 30.88 | — | No fix listed | CNA |
| Canon Inc. | CARPS2 Printer Driver | up to 31.01 | — | No fix listed | CNA |
| Canon Inc. | PDF Driver | up to 1.0.5.0 | — | No fix listed | CNA |
| Canon Inc. | LIPS4 Printer Driver | up to 15.00 | — | No fix listed | CNA |
| Canon Inc. | LIPSLX Printer Driver | up to 15.00 | — | No fix listed | CNA |
| Canon Inc. | UFR II Printer Driver | up to 15.00 | — | No fix listed | CNA |
| Canon Inc. | PS Printer Driver | up to 15.00 | — | No fix listed | CNA |
| Canon Inc. | PCL6 Printer Driver | up to 15.00 | — | No fix listed | CNA |
- Generic Plus PCL6 Printer Driver VendorCanon Inc. Affected up to 3.12 Fixed in — No fix listed CNA
- Generic Plus UFR II Printer Driver VendorCanon Inc. Affected up to 3.12 Fixed in — No fix listed CNA
- Generic Plus LIPS4 Printer Driver VendorCanon Inc. Affected up to 3.12 Fixed in — No fix listed CNA
- Generic Plus LIPSLX Printer Driver VendorCanon Inc. Affected up to 3.12 Fixed in — No fix listed CNA
- Generic Plus PS Printer Driver VendorCanon Inc. Affected up to 3.12 Fixed in — No fix listed CNA
- Generic FAX Printer Driver VendorCanon Inc. Affected up to 10.65 Fixed in — No fix listed CNA
- UFRII LT Printer Driver VendorCanon Inc. Affected up to 30.88 Fixed in — No fix listed CNA
- CARPS2 Printer Driver VendorCanon Inc. Affected up to 31.01 Fixed in — No fix listed CNA
- PDF Driver VendorCanon Inc. Affected up to 1.0.5.0 Fixed in — No fix listed CNA
- LIPS4 Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
- LIPSLX Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
- UFR II Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
- PS Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
- PCL6 Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1268
- 2026-10-03 Alias added: GHSA-r2rc-9fhh-m65x
References
Advisory 4
- https://psirt.canon/advisory-information/cp2025-003/
- https://canon.jp/support/support-info/250328vulnerability-response
- https://www.usa.canon.com/about-us/to-our-customers/service-notice-vulnerability-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-and-laser-printers
- https://www.canon-europe.com/support/product-security/
More Canon Inc. vulnerabilities
- TI-2006-01145 Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote… CVSS 2.0HIGH 7.5
- TI-2006-01147 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2025-01879 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11733 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-1268 · CVE Program
- CVE-2025-1268 · NVD
- FIRST EPSS
- GHSA-r2rc-9fhh-m65x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences