CVE-2026-50100

Vulnerability

Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability (CWE-427: Uncontrolled Search Path Element). The vulnerability occurs due to insecure DLL loading. An attacker who can log in to a computer running an affected printer driver can exploit this by placing a specially crafted driver (e.g., a malicious DLL) in a location where the vulnerable driver will load it. Affected products include specific printer drivers from both vendors; for example, Konica Minolta 1422W printers with RPCS driver version 1.5.0.0 or earlier, PS driver version 1.3.0.0 or earlier, and PC FAX driver version 13.0 or earlier [4]. Ricoh's affected products and versions are listed on their security advisory [1][2].

Exploitation

To exploit this vulnerability, an attacker must have local access to a system and be able to log in. The attacker then places a specially crafted driver file (likely a DLL) into a directory that the vulnerable printer driver searches for dependencies. When the driver is loaded (e.g., during a print job), the malicious DLL is loaded instead of the legitimate one, executing arbitrary code with the privileges of the driver process. No user interaction beyond the attacker's own login is required; the attack is initiated by the attacker themselves.

Impact

Successful exploitation allows an attacker to elevate privileges to SYSTEM or administrator level, depending on the driver's execution context. This can lead to full compromise of the affected system, including arbitrary code execution, installation of programs, and access to sensitive data. The CVSS v3 base score is 7.8 (High), indicating high impact on confidentiality, integrity, and availability [3].

Mitigation

The vendors have released updated driver versions that fix this vulnerability. For Konica Minolta 1422W, users should update to RPCS driver version 1.5.0.1 or later, PS driver version 1.3.0.1 or later, and PC FAX driver version 13.1 or later [4]. Ricoh users should refer to the vendor's advisory for their specific products and apply the latest drivers [1][2]. As of June 15, 2026, patches are available. No workarounds are mentioned; updating is the recommended solution.