Image Scanner Driver EUVD-2026-89569

Exploitation requires the attacker to already have interactive login access to the Linux host where the PFU Image Scanner Driver for Linux (fi series or sp series) is installed (AV:L, PR:L). The description explicitly states the attacker must make 'certain preparations,' consistent with the high attack complexity (AC:H) and passive user interaction (UI:P) in the vector - meaning exploitation is not one-shot and depends on staging specific conditions and/or a triggering action involving another user or scan operation. Limiting factors: no network exploitation path, a valid local account is mandatory, the vulnerable scanner driver package must be installed, and the AC:H/UI requirement means default, unattended systems are not trivially exploitable.

This is a genuinely moderate, not high, priority. The CVSS 4.0 vector (AV:L/AC:H/PR:L/UI:P) makes exploitation demanding: the attacker must already be able to log in to the Linux host (local vector, low privileges), succeed against high attack complexity, and rely on passive user interaction plus 'certain preparations' as the description states. Against those hurdles, the payoff is full compromise of the vulnerable system (VC:H/VI:H/VA:H) with no scope change - effectively a local privilege-escalation / command-execution primitive rather than a remotely reachable flaw. No EPSS score, CISA KEV entry, or public exploit code is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There are no strongly conflicting signals: the CVSS local vector is consistent with the description's 'log in to a Linux system' phrasing. The main uncertainty is what the vague 'making certain preparations' entails, which likely maps to the AC:H rating; the vendor advisory (PFU/Ricoh) and JVN should be consulted for the concrete precondition.

An attacker with an existing low-privileged shell on a Linux machine that has the PFU Image Scanner Driver (fi or sp series) installed stages the required preconditions and triggers the driver to process attacker-influenced input, causing an unsanitized value to be passed to an OS command. Because the flaw yields full C/I/A impact locally, this typically results in command execution at the driver's privilege level, potentially escalating from the initial local account. No public proof-of-concept is present in the provided intelligence, and high attack complexity plus required user interaction make it a targeted rather than trivial operation.