The Image Scanner Driver for Linux (fi Series) contains an improper link resolution vulnerability (CVE-2026-81310) that allows an authenticated attacker with local login privileges to overwrite arbitrary files. This occurs due to the driver's failure to correctly handle symbolic links before accessing files, enabling a 'link following' attack. The vulnerability affects several specific versions of the driver, including 2.0.0, 2.3.0, 2.3.2, 2.5.0, and ranges 2.1.0 through 2.1.1 (including 2.1.1-4), 2.2.0 through 2.2.2, 2.7.0 through 2.7.1, and 2.8.0 through 2.8.2. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

An attacker who can log in locally to a system running an affected version of the Image Scanner Driver for Linux can exploit this vulnerability to overwrite arbitrary files. This can lead to integrity and availability impacts on the system, such as modifying or corrupting critical files. There is no confidentiality impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local login access to trusted users only and monitor for suspicious activity related to the scanner driver. Avoid running the driver with unnecessary privileges. Follow vendor updates closely for patches or official mitigations.