CVE-2026-1585 is a vulnerability classified under CWE-428 (Unquoted Search Path or Element) affecting Canon Inc.'s IJ Scan Utility for Windows, specifically versions 1.1.2 through 1.5.0. The flaw exists because the Windows service executable path is not enclosed in quotes, which is problematic when the path contains spaces. Windows command-line parsing can interpret the path incorrectly, causing the system to search for executables in unintended directories. A local attacker with high privileges can exploit this by placing a malicious executable in one of these directories, which the system may execute with the service's privileges. This leads to privilege escalation, allowing the attacker to execute arbitrary code with elevated rights. The vulnerability does not require user interaction or authentication beyond local access with elevated privileges, increasing its risk in environments where multiple users have such access. The CVSS 4.0 base score is 8.4, reflecting high severity due to the potential impact on system confidentiality, integrity, and availability. No patches or exploits are currently reported, but the vulnerability is publicly disclosed and should be addressed promptly.

The primary impact of CVE-2026-1585 is local privilege escalation, enabling an attacker with existing high-level access to execute arbitrary code with the same or higher privileges as the IJ Scan Utility service. This can lead to full system compromise, unauthorized data access, modification, or destruction, and disruption of service availability. In enterprise environments, this vulnerability could be leveraged to move laterally or escalate privileges within a network, increasing the attack surface and risk of broader compromise. Since the IJ Scan Utility is commonly used in office environments with Canon multifunction devices, organizations relying on these tools may face increased risk of insider threats or attacks from compromised local accounts. The lack of required user interaction or authentication beyond local access means that once an attacker gains foothold, exploitation is straightforward, potentially bypassing other security controls.

To mitigate CVE-2026-1585, organizations should first check for and apply any available patches or updates from Canon addressing this vulnerability. In the absence of official patches, administrators can manually verify and correct the service executable path by enclosing it in quotes to prevent Windows from misinterpreting the path. Restrict local user permissions to minimize the number of users with high privileges capable of exploiting this vulnerability. Employ application whitelisting to prevent unauthorized executables from running in directories used by the service. Regularly audit and monitor service configurations and file system locations for suspicious files or changes. Additionally, consider isolating or limiting the use of IJ Scan Utility on critical systems or deploying endpoint detection and response (EDR) solutions to detect anomalous behavior indicative of exploitation attempts.