Read the docs
TI-2025-09089 Aliases CVE-2025-9904GHSA-hv8v-h5q2-gmv5

Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer…

Priority LOW 37CWE-696Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canon Inc.Generic Plus PCL6 Printer Driverup to 3.30—No fix listedCNA
Canon Inc.Generic Plus UFR II Printer Driverup to 3.30—No fix listedCNA
Canon Inc.Generic Plus LIPS4 Printer Driverup to 3.30—No fix listedCNA
Canon Inc.Generic Plus LIPSLX Printer Driverup to 3.30—No fix listedCNA
Canon Inc.Generic Plus PS Printer Driverup to 3.30—No fix listedCNA
Canon Inc.UFRII LT Printer Driverup to 31.05—No fix listedCNA
Canon Inc.CARPS2 Printer Driverup to 31.05—No fix listedCNA
Canon Inc.Generic FAX Driverup to 10.67—No fix listedCNA
Canon Inc.LIPS4 Printer Driverup to 15.00—No fix listedCNA
Canon Inc.LIPSLX Printer Driverup to 15.00—No fix listedCNA
Canon Inc.UFR II Printer Driverup to 15.00—No fix listedCNA
Canon Inc.PS Printer Driverup to 15.00—No fix listedCNA
Canon Inc.PCL6 Printer Driverup to 15.00—No fix listedCNA
  • Generic Plus PCL6 Printer Driver VendorCanon Inc. Affected up to 3.30 Fixed in — No fix listed CNA
  • Generic Plus UFR II Printer Driver VendorCanon Inc. Affected up to 3.30 Fixed in — No fix listed CNA
  • Generic Plus LIPS4 Printer Driver VendorCanon Inc. Affected up to 3.30 Fixed in — No fix listed CNA
  • Generic Plus LIPSLX Printer Driver VendorCanon Inc. Affected up to 3.30 Fixed in — No fix listed CNA
  • Generic Plus PS Printer Driver VendorCanon Inc. Affected up to 3.30 Fixed in — No fix listed CNA
  • UFRII LT Printer Driver VendorCanon Inc. Affected up to 31.05 Fixed in — No fix listed CNA
  • CARPS2 Printer Driver VendorCanon Inc. Affected up to 31.05 Fixed in — No fix listed CNA
  • Generic FAX Driver VendorCanon Inc. Affected up to 10.67 Fixed in — No fix listed CNA
  • LIPS4 Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
  • LIPSLX Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
  • UFR II Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
  • PS Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA
  • PCL6 Printer Driver VendorCanon Inc. Affected up to 15.00 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Canon CARPS2 Printer Driver, Generic FAX Driver and 11 more products — canon.jp/support/support-info/250925vulnerability-response

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-09088 Out-of-bounds write in Canon Inc. Generic Plus PCL6 Printer DriverPriority LOW 26
    • TI-2025-07025 Out-of-bounds read in Canon Inc. Generic Plus PCL6 Printer DriverPriority LOW 26
    Show all 3 records → Advisory →
  • Advisory ·

    Canon CARPS2 Printer Driver, Generic FAX Driver and 11 more products — psirt.canon/advisory-information/cp2025-005

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-09088 Out-of-bounds write in Canon Inc. Generic Plus PCL6 Printer DriverPriority LOW 26
    • TI-2025-07025 Out-of-bounds read in Canon Inc. Generic Plus PCL6 Printer DriverPriority LOW 26
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Canon CARPS2 Printer Driver, Generic FAX Driver and 11 more products — usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerab…

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-09088 Out-of-bounds write in Canon Inc. Generic Plus PCL6 Printer DriverPriority LOW 26
    • TI-2025-07025 Out-of-bounds read in Canon Inc. Generic Plus PCL6 Printer DriverPriority LOW 26
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9904
  2. 2026-10-03 Alias added: GHSA-hv8v-h5q2-gmv5

References

Advisory 4

  • TI-2006-01145 Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote… CVSS 2.0HIGH 7.5
  • TI-2006-01147 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
  • TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
  • TI-2025-01879 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
  • TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
  • TI-2024-11733 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences