EUVD-2026-36701
GHSA-7c4j-4vwf-c9vr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryIdentify installed Ricoh/Konica Minolta driver
-
ExploitPlant crafted driver in search path
-
ExecutionTrigger driver load via spooler/install
-
PersistCode executes as SYSTEM
-
ImpactEstablish persistence on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires the attacker to already be able to log in to a Windows host (interactively, via RDP, or via remote shell) that has one of the affected Ricoh or Konica Minolta printer drivers installed, and to be able to write a 'specially crafted driver' file into a path consulted by the vulnerable driver's search logic. PR:L means a normal authenticated user account is sufficient - no admin rights needed - and UI:N means no second user must interact. Exploitation is LIMITED by the local-only attack vector (AV:L, not remotely reachable), by the requirement that one of these specific vendor drivers actually be present, and by host hardening such as restrictive ACLs on driver/spooler directories or Group Policy that blocks non-admin driver installation. |
| Impact | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H accurately frames this as a local, low-complexity, low-privilege-required elevation to full SYSTEM-equivalent impact - a classic post-compromise pivot rather than an internet-reachable break-in. There is no EPSS data, no KEV listing, and no public POC referenced, so this is not a mass-exploitation candidate; however, attackers and red teams routinely chain printer-driver EoP bugs after initial foothold (e.g., phishing, RDP, stolen credentials), so realistic risk on managed Windows fleets with Ricoh or Konica Minolta MFPs is meaningful. SC/SI/SA are all N, so impact stays within the compromised host; no scope change. Key data gap: the advisories enumerate specific driver versions in Japanese vendor bulletins that were not parsed into this input, so exact fixed-version mapping must be confirmed against the Ricoh and Konica Minolta security pages. |
| Exploit ScenarioDerived | A standard domain user who has obtained an interactive or remote session on a workstation (e.g., via phishing or stolen credentials) drops a malicious DLL or driver file into a location that an affected Ricoh or Konica Minolta print driver resolves during install, update, or job rendering. When the spooler or driver helper - running as SYSTEM - loads the crafted component, the attacker's code executes with elevated privileges, yielding full host compromise. No POC has been published, but CWE-427 chains are well understood and trivially developed by experienced operators. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Local privilege escalation in multiple Ricoh and Konica Minolta printer drivers on Windows hosts allows an authenticated low-privileged user to gain higher privileges by supplying a specially crafted driver component. The flaw is rooted in CWE-427 (Uncontrolled Search Path Element), and at time of analysis no public exploit identified at time of analysis. CVSS 4.0 of 8.5 reflects high confidentiality, integrity, and availability impact despite requiring local access.
RemediationAI
Patch available per vendor advisory: update each affected Ricoh and Konica Minolta printer driver to the fixed build listed in https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000002 and https://www.konicaminolta.jp/business/support/important/260615_01_01.html, cross-checked against the JVN coordination notice at https://jvn.jp/en/jp/JVN55319858/. Until patched drivers are deployed, restrict standard users from writing to driver installation, spooler, and per-printer driver directories (lock down ACLs on %WINDIR%\System32\spool\drivers and any vendor-specific 'Driver' folders), disable Point and Print non-administrator driver installation via the Group Policy 'Limits print driver installation to Administrators' setting, and remove unused Ricoh/Konica Minolta print queues from shared endpoints - note that these controls will break self-service driver installs and may require help-desk involvement for legitimate printer setup. Monitor for unexpected DLLs or driver files appearing in driver search paths as a detective control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Printer drivers on Windows typically execute portions of their installation and update logic in the context of the print spooler service or other SYSTEM-level processes. CWE-427 (Uncontrolled Search Path Element) covers cases where a privileged process loads a DLL, executable, or driver component from a directory writable by a low-privileged user, or follows a search order that can be hijacked. In this case, both Ricoh and Konica Minolta ship multiple printer driver packages (per the CPE strings cpe:2.3:a:ricoh_company,_ltd.:multiple_printer_drivers and cpe:2.3:a:konica_minolta_japan,_inc.:multiple_printer_drivers) that resolve a driver-related path insecurely, allowing a planted 'crafted driver' to be loaded with elevated rights during driver install, update, or print job processing.
Know when Multiple Printer Drivers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local authenticated user (PR:L, AV:L) plants a driver file with no user interaction; vulnerable driver loads it as SYSTEM giving full C/I/A on the host with no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
1DescriptionCVE.org
Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer driver could elevate privileges by using a specially crafted driver.
Executive ViewAI
Ricoh and Konica Minolta printer drivers on Windows systems contain a local privilege escalation vulnerability (CVE-2026-50100, CVSS 8.5) that allows low-privileged users with local system access to gain higher privileges, compromising confidentiality, integrity, and availability. This vulnerability poses direct risk to any organization running these printer drivers and represents an immediate threat to Windows endpoint security posture.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict execution and modification of printer driver files through application whitelisting or Group Policy; (2) Implement endpoint detection and response (EDR) to alert on privilege escalation attempts from low-privileged processes; (3) Apply principle of least privilege and limit local user account permissions; (4) Evaluate transition to printer models from vendors with confirmed patches or unaffected product lines; (5) Disable non-essential driver features and components.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB