CVE-2025-9904

Executive Summary

CVE-2025-9904 is a high-severity vulnerability affecting multiple Canon printer drivers, including Generic Plus PCL6, UFR II, LIPS4, LIPSLX, PS, FAX, and CARPS2 drivers. The flaw resides in the print processing component, where unallocated memory access occurs, leading to a potential denial-of-service (DoS) condition. An attacker can exploit this by sending a specially crafted print job to a system running an affected driver, causing the driver to crash or become unresponsive. The CVSS score of 5.3 reflects a medium severity, but the local attack vector and user interaction requirements limit remote exploitation. No public proof-of-concept (PoC) or exploit code is available at this time, and the vendor has not released a patch. This vulnerability poses a risk to enterprise environments where Canon printers are deployed, as it can disrupt printing operations and potentially be leveraged in a broader attack chain.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to send a print job locally.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must print a malicious document or job.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The driver crash leads to a denial of service.

Threat Level: Medium. The vulnerability requires local access and user interaction, but it can be exploited to disrupt printing services in enterprise environments. The lack of a patch increases the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is an unallocated memory access (CWE-824) in the print processing component of multiple Canon printer drivers. When a specially crafted print job is processed, the driver attempts to read from or write to a memory location that has not been properly allocated. This can occur due to improper validation of print job parameters, such as page dimensions, color profiles, or embedded fonts.

Technical Details:

• The affected drivers include: Generic Plus PCL6, Generic Plus UFR II, Generic Plus LIPS4, Generic Plus LIPSLX, Generic Plus PS, UFRII LT, CARPS2, Generic FAX, LIPS4, LIPSLX, UFR II, PS, and PCL6.
• The flaw is triggered during the parsing of print job data, specifically when handling certain PDL (Page Description Language) commands.
• An attacker can craft a malicious document (e.g., a PDF or a specially formatted print file) that, when printed, causes the driver to access unallocated memory.
• This results in a crash (denial of service) of the print spooler or the driver itself, potentially affecting all print jobs on the system.

Attack Vector:

• The attacker must have local access to the system or be able to send a print job to a shared printer.
• The victim must print the malicious document, either by opening it or by sending it to the printer.
• The vulnerability does not allow code execution or data exfiltration; it only impacts availability.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison cannot be made. However, based on the CWE-824 description, the vulnerable code likely lacks proper bounds checking or memory allocation validation. A patched version would include:

• Vulnerable Code (Conceptual):

  void process_print_job(char *data, int size) {
      char *buffer = malloc(size);
      // No check if malloc succeeded
      memcpy(buffer, data, size);
      // Process buffer without validating size
      parse_pdl_commands(buffer, size);
  }
  

• Patched Code (Conceptual):

  void process_print_job(char *data, int size) {
      if (size <= 0 || size > MAX_JOB_SIZE) {
          return; // Reject invalid size
      }
      char *buffer = malloc(size);
      if (!buffer) {
          return; // Handle allocation failure
      }
      memcpy(buffer, data, size);
      // Validate buffer contents before processing
      if (!validate_pdl_commands(buffer, size)) {
          free(buffer);
          return;
      }
      parse_pdl_commands(buffer, size);
      free(buffer);
  }
  

The patched code would include input validation, memory allocation checks, and proper error handling to prevent unallocated memory access.

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial-of-service condition on a target system running an affected Canon printer driver.

Prerequisites:

• A Windows system with an affected Canon printer driver installed.
• Ability to send a print job to the printer (local or network).

Steps:

1. Identify Target: Use Shodan or local network scanning to find systems with Canon printer drivers (e.g., port 9100 for raw printing).
2. Craft Malicious Print Job: Create a specially crafted PCL6 or UFR II print job that triggers the unallocated memory access. Since no public exploit exists, this requires reverse engineering the driver. A simple approach is to send malformed PDL commands:

   # Example: Send a malformed PCL6 job
   import socket
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(("target_ip", 9100))
   # Malformed PCL6 data (e.g., invalid page size)
   payload = b"\x1B%-12345X@PJL JOB NAME=\"Exploit\"\r\n" + b"\x1B%1B" + b"\x00" * 1000
   sock.send(payload)
   sock.close()
   

3. Trigger Print: The victim must print the malicious document. This can be done by sending it to a shared printer or tricking the user into printing it.
4. Observe Impact: The print spooler or driver crashes, causing a denial of service for all print jobs.

Blue Team

Objective: Detect and mitigate exploitation attempts.

Detection:

• Monitor print spooler logs for crashes or errors (Event ID 7031, 7032, 7034).
• Use network monitoring to detect malformed print jobs (e.g., unusual PDL commands).
• Implement endpoint detection rules for driver crashes.

Mitigation:

• Disable or restrict access to affected printer drivers until a patch is available.
• Use application whitelisting to prevent unauthorized print jobs.
• Implement network segmentation to limit exposure of print services.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• Network Indicators:
  • Unusual print jobs sent to port 9100 (raw printing) or 515 (LPD).
  • Print jobs with malformed PDL headers (e.g., invalid escape sequences).
• System Indicators:
  • Print spooler crashes (Event ID 7031, 7032, 7034).
  • Driver crashes in spoolsv.exe or Canon*.dll.
  • Memory dumps from print driver processes.
• Behavioral Indicators:
  • Repeated print job failures.
  • High CPU usage by print spooler during job processing.

Detection Engineering

YARA Rule

rule CVE_2025_9904_Canon_Printer_Driver {
    meta:
        description = "Detects malformed print jobs targeting Canon printer drivers"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-9904"
    strings:
        $pcl6_header = "\x1B%-12345X@PJL" ascii wide
        $ufr2_header = "\x1B%1B" ascii wide
        $malformed = { 00 00 00 00 00 00 00 00 } // Example pattern
    condition:
        ($pcl6_header or $ufr2_header) and #malformed > 10
}

Sigma Rule

title: Canon Printer Driver Crash Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects print spooler crashes indicative of CVE-2025-9904 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID:
            - 7031
            - 7032
            - 7034
        Source: "Service Control Manager"
        ServiceName: "Spooler"
    condition: selection
falsepositives:
    - Legitimate driver crashes due to other issues
level: high

Suricata Rule

alert tcp any any -> any 9100 (msg:"CVE-2025-9904 Canon Printer Driver Exploit Attempt"; flow:to_server,established; content:"|1B|%-12345X@PJL"; depth:20; content:"|1B|%1B"; distance:0; within:10; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Affected Drivers: If possible, switch to alternative printer drivers or disable the affected Canon drivers until a patch is released.
2. Restrict Print Access: Limit print job submission to trusted users only. Use group policies to control printer access.
3. Monitor for Crashes: Enable logging for print spooler crashes and investigate any anomalies.

Long-Term Fix:

• Vendor Patch: Await an official patch from Canon. Monitor Canon's security advisory page for updates.
• Driver Update: Once available, update all affected drivers to the patched version.
• Network Segmentation: Isolate printers on a separate VLAN to reduce exposure.

Workarounds:

• Use a different printer driver (e.g., PostScript or PCL5) if available.
• Implement print job validation using a print server that filters malformed jobs.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.