CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2025-14232

CVSS 9.3v4.0pub. 2026-01-16upd. 2026-01-26

Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The attacker sends a specially crafted XPS file containing maliciously constructed XML data to the device. During parsing of this file, a buffer overflow occurs (CWE-787 — out-of-bounds write in process memory), leading to memory corruption of the print job handling process. The error occurs without authentication requirement, and the attack itself is possible for any host in the same network segment as the device.

Impact

An attacker can cause permanent device unavailability (hang or restart) or execute arbitrary code (RCE) in the context of the printer firmware, which may result in complete takeover of the device.

Mitigation & patch

Firmware on devices should be updated to a version newer than v06.02. Patches and detailed update instructions are available in official Canon security communications: for Japan at canon.jp/support, for USA at usa.canon.com, for Europe at canon-europe.com and in the Canon PSIRT bulletin (cp2026-001). Until the patch is implemented, it is recommended to isolate devices on the network (e.g., dedicated VLAN segment or firewall) so that only trusted hosts have access to the printers.

Who is affected

Canon devices with firmware version v06.02 and earlier: Satera LBP670C Series / Satera MF750C Series (Japan); Color imageCLASS LBP630C / Color imageCLASS MF650C Series / imageCLASS LBP230 Series / imageCLASS X LBP1238 II / imageCLASS MF450 Series / imageCLASS X MF1238 II / imageCLASS X MF1643i II / imageCLASS X MF1643iF II (USA); i-SENSYS LBP630C Series / i-SENSYS MF650C Series / i-SENSYS LBP230 Series / 1238P II / 1238Pr II / i-SENSYS MF450 Series / i-SENSYS MF550 Series / 1238i II / 1238iF II / imageRUNNER 1643i II / imageRUNNER 1643iF II (Europe). Products listed in metadata: Canon MF455DW, MF453DW, MF452DW and their firmware.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X