CVE-2025-14235

Published: Jan 16, 2026Modified: Jun 17, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd (Secondary)

Description

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Affected (16)

Products: Canon: Mf656cdw Firmware, Mf653cdw Firmware, Mf652cw Firmware, Mf1238 Ii Firmware, Mf1643if Ii Firmware, Mf1643i Ii Firmware, Lbp237dw Firmware, Lbp236dw Firmware, Lbp633cdw Firmware, Lbp632cdw Firmware, Lbp1238 Ii Firmware, Mf455dw Firmware, Mf453dw Firmware, Mf452dw Firmware, Mf451dw Firmware, Mf654cdw Firmware

16 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf656cdw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf656cdw	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf653cdw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf653cdw	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf652cw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf652cdw	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1238 Ii Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf1238 Ii	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1643if Ii Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf1643if Ii	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1643i Ii Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf1643i Ii	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp237dw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Lbp237dw	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp236dw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Lbp236dw	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp633cdw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Lbp633cdw	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp632cdw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Lbp632cdw	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp1238 Ii Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Lbp1238 Ii	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf455dw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf455dw	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf453dw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf453dw	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf452dw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf452dw	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf451dw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf451dw	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf654cdw Firmware	Up to 06.02

Running on/with	Platform Versions
Canon Mf654cdw	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

https://canon.jp/support/support-info/260115vulnerability-response

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

https://psirt.canon/advisory-information/cp2026-001/

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

https://www.canon-europe.com/support/product-security/

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

Timeline

No history available yet.