What is the CVSS score of CVE-2025-9903?

CVE-2025-9903 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of HP are affected by CVE-2025-9903?

CVE-2025-9903 presents moderate security risk, a out-of-bounds write vulnerability rated CVSS 5.9. Exploitation could cause memory corruption or application crashes.

How to fix or mitigate CVE-2025-9903?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

HP CVE-2025-9903

MEDIUM

Out-of-bounds Write (CWE-787)

2025-09-29 f98c90f0-e9bd-4fa7-911b-51993f3571fd

Buffer Overflow HP Denial Of Service

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 16, 2026 - 14:30 vuln.today

CVE Published

Sep 29, 2025 - 01:15 nvd

MEDIUM 5.9

DescriptionCVE.org

Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer Driver / LIPSLX Printer Driver / UFR II Printer Driver / PS Printer Driver / PCL6 Printer Driver

AnalysisAI

Out-of-bounds write vulnerabilities exist in the print processing functionality of multiple Canon printer drivers, including Generic Plus variants (PCL6, UFR II, LIPS4, LIPSLX, PS) and standalone drivers (UFRII LT, CARPS2, Generic FAX, LIPS4, LIPSLX, UFR II, PS, PCL6). An attacker can exploit these memory corruption flaws via a malicious print job to corrupt memory, potentially leading to code execution or denial of service. The EPSS score of 0.04% (13th percentile) suggests low exploitation probability in the wild, and no active KEV status has been reported, indicating this is not currently being exploited at scale.

Technical ContextAI

The vulnerability class CWE-787 (Out-of-bounds Write) indicates a buffer overflow condition in the print processing pipeline where user-controlled input from print jobs is written beyond allocated memory boundaries. This affects Canon's printer driver ecosystem spanning multiple print languages and protocols: PCL6 (Printer Command Language 6), UFR II (Universal Front-end Roaming), LIPS4 (Line Imaging Printing System), LIPSLX (LIPS with extended capabilities), PS (PostScript), CARPS2 (Canon Advanced Raster Printing System 2), and FAX rendering engines. The vulnerability exists in the input validation or buffer allocation routines that process print job data before transmission to or processing by the printer hardware, allowing attackers to write arbitrary data to memory regions used by the driver process.

Affected ProductsAI

Canon's printer driver portfolio is affected, including Generic Plus PCL6 Printer Driver, Generic Plus UFR II Printer Driver, Generic Plus LIPS4 Printer Driver, Generic Plus LIPSLX Printer Driver, Generic Plus PS Printer Driver, UFRII LT Printer Driver, CARPS2 Printer Driver, Generic FAX Driver, standalone LIPS4 Printer Driver, standalone LIPSLX Printer Driver, standalone UFR II Printer Driver, standalone PS Printer Driver, and standalone PCL6 Printer Driver. Specific version ranges are not detailed in available advisories but Canon has published comprehensive security information via https://canon.jp/support/support-info/250925vulnerability-response, https://psirt.canon/advisory-information/cp2025-005/, and https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers. Affected deployments include production printer environments, office multifunction printers, small office printers, and laser printer systems.

RemediationAI

Obtain and deploy the latest Canon printer driver versions from the vendor's security advisory portal at https://psirt.canon/advisory-information/cp2025-005/ or regional support sites such as Canon Europe (https://www.canon-europe.com/support/product-security/) and Canon USA (https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers). Prioritize updating driver versions for production printer fleets, office multifunction devices, and network-connected laser printers. As a compensating control, restrict print job submissions to trusted internal sources only via print server access lists and network segmentation, disable network printing from untrusted sources, and monitor print job processing logs for anomalous behavior. Test driver updates in a staging environment before production deployment to ensure compatibility with existing workflows.