Critical severity · published Jan 15, 2026
CVE-2025-14237
Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…
9.8
CVSS
1%
EPSS
No
On KEV
Description
Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1I
1238P II · Canon Inc.
06.02 and earlier · source: vendor
1I
1238Pr II · Canon Inc.
06.02 and earlier · source: vendor
1I
1238i II · Canon Inc.
06.02 and earlier · source: vendor
1I
1238iF II · Canon Inc.
06.02 and earlier · source: vendor
CI
Color imageCLASS LBP630C · Canon Inc.
06.02 and earlier · source: vendor
CI
Color imageCLASS MF650C Series · Canon Inc.
06.02 and earlier · source: vendor
SL
Satera LBP670C Series · Canon Inc.
06.02 and earlier · source: vendor
SM
Satera MF750C Series · Canon Inc.
06.02 and earlier · source: vendor
IL
i-SENSYS LBP230 Series · Canon Inc.
06.02 and earlier · source: vendor
IL
i-SENSYS LBP630C Series · Canon Inc.
06.02 and earlier · source: vendor
IM
i-SENSYS MF450 Series · Canon Inc.
06.02 and earlier · source: vendor
IM
i-SENSYS MF550 Series · Canon Inc.
06.02 and earlier · source: vendor
In the news
VulnerabilityCritical
ZDI-26-208: (Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF654Cdw printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-14237.
Mar 16, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14237
Vendor Advisory
https://canon.jp/support/support-info/260115vulnerability-response
Vendor Advisory
https://psirt.canon/advisory-information/cp2026-001/
Vendor Advisory
https://www.canon-europe.com/support/product-security/
Vendor Advisory
https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers
More from 1238i II
9.8
CVE-2025-14236
Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected…
9.8
CVE-2025-14235
Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…
9.8
CVE-2025-14234
Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected…
9.8
CVE-2025-14233
Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…
9.8
CVE-2025-14232
Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…