Out-of-bounds write in Canon Inc. Satera LBP670C Series
Priority MEDIUM 50CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00902 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canon Inc. | Satera LBP670C Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | Satera MF750C Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS LBP630C | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS MF650C Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS LBP230 Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X LBP1238 II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS MF450 Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X MF1238 II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X MF1643i II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X MF1643iF II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS LBP630C Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF650C Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS LBP230 Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | 1238P II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | 1238Pr II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF450 Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF550 Series | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | 1238i II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | 1238iF II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageRUNNER 1643i II | up to 06.02 | — | No fix listed | CNA |
| Canon Inc. | imageRUNNER 1643iF II | up to 06.02 | — | No fix listed | CNA |
- Satera LBP670C Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- Satera MF750C Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- Color imageCLASS LBP630C VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- Color imageCLASS MF650C Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageCLASS LBP230 Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageCLASS X LBP1238 II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageCLASS MF450 Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageCLASS X MF1238 II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageCLASS X MF1643i II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageCLASS X MF1643iF II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- i-SENSYS LBP630C Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- i-SENSYS MF650C Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- i-SENSYS LBP230 Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- 1238P II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- 1238Pr II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- i-SENSYS MF450 Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- i-SENSYS MF550 Series VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- 1238i II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- 1238iF II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageRUNNER 1643i II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
- imageRUNNER 1643iF II VendorCanon Inc. Affected up to 06.02 Fixed in — No fix listed CNA
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canon:mf656cdw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf656cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf653cdw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf653cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf652cw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf652cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf1238_ii_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf1643if_ii_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
- cpe:2.3:o:canon:mf656cdw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf656cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf653cdw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf653cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf652cw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf652cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf1643if_ii_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canon:mf1643i_ii_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:lbp237dw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:lbp236dw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:lbp633cdw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:lbp633cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:lbp632cdw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:lbp632cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:lbp1238_ii_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf654cdw_firmware:*:*:*:*:*:*:*:* | up to 06.02 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf654cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
- cpe:2.3:o:canon:mf1643i_ii_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:lbp237dw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:lbp236dw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:lbp633cdw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:lbp633cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:lbp632cdw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:lbp632cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:lbp1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf654cdw_firmware:*:*:*:*:*:*:*:* Versions up to 06.02 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf654cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Canon 1238P II, 1238Pr II and 19 more products — canon.jp/support/support-info/260115vulnerability-response
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2025-13015 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- TI-2025-13014 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- TI-2025-13012 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- Advisory ·
Canon 1238P II, 1238Pr II and 19 more products — psirt.canon/advisory-information/cp2026-001
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2025-13015 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- TI-2025-13014 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- TI-2025-13012 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
Show 1 more group
- Advisory ·
Canon 1238P II, 1238Pr II and 19 more products — usa.canon.com/support/canon-product-advisories/Service-Noti…
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2025-13015 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- TI-2025-13014 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
- TI-2025-13012 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 50
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14235
- 2026-10-03 Alias added: GHSA-wcv5-68f6-32pr
References
Advisory 4
- https://psirt.canon/advisory-information/cp2026-001/
- https://canon.jp/support/support-info/260115vulnerability-response
- https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers
- https://www.canon-europe.com/support/product-security/
More Canon Inc. Lbp1238 Ii Firmware vulnerabilities
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11733 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11732 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2025-13015 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 4.0CRITICAL 9.3
- TI-2025-13014 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-14235 · CVE Program
- CVE-2025-14235 · NVD
- FIRST EPSS
- GHSA-wcv5-68f6-32pr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences