Image Scanner Driver CVE-2026-81310

Exploitation requires the attacker to already have a local login on the Linux system where the Image Scanner Driver for Linux (fi series or sp series) is installed (AV:L, PR:L). The attacker must pre-position a symbolic link ('a special method in advance') so that a privileged driver operation follows it and overwrites an arbitrary file; success also depends on the victim/privileged process performing the vulnerable write (UI:P passive interaction). Limiting factors: no network vector, no unauthenticated path, and the target file overwrite only yields integrity/availability impact - there is no confidentiality impact. Exploitation is confined to hosts that have this specific PFU/Ricoh scanner driver installed.

This is a genuinely medium-risk local privilege/integrity issue, not a high-CVSS-but-hollow finding - but it is also not a top-tier priority because it cannot be exploited remotely. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) scores 5.2, and the metrics are internally consistent with the description: the attacker must already be able to log in to the Linux host (AV:L, PR:L), and exploitation depends on a privileged component acting on an attacker-planted symlink (UI:P - passive interaction by the victim/service). Impact is integrity and availability only (VI:H/VA:H, VC:N), matching a CWE-59 link-following file-overwrite primitive rather than a data-theft bug. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The main signal to weigh is that all remote/network signals are absent - this requires an existing local foothold - which sharply limits real-world urgency despite the arbitrary-overwrite (potentially root-level, hence privilege-escalation-capable) impact. Note the 'Information Disclosure' tag conflicts with the CVSS impact metrics (VC:N/C:N), so it should not drive triage.

A user with a local login on a Linux host running the PFU/Ricoh Image Scanner Driver pre-plants a symbolic link ('a special method in advance') at a path the driver's privileged component later writes to. When the scanner driver or its helper process performs that write, it follows the attacker's symlink and overwrites an arbitrary file (e.g. a root-owned configuration or binary), enabling privilege escalation or denial of service. No public exploit code was identified in the provided data, and exploitation requires the attacker to already possess local access.