CVE-2025-14235 Vulnerability Analysis & Exploit Intelligence

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Published Jan 15, 2026Updated Feb 26, 2026Sources: cvelistV5, Canon

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

canon

21 products listed

CVSS base

9.8

CRITICAL

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

Yes

can an attacker script all four kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

canon

Products (21)

satera lbp670c seriessatera mf750c seriescolor imageclass lbp630ccolor imageclass mf650c seriesimageclass lbp230 seriesimageclass x lbp1238 iiimageclass mf450 seriesimageclass x mf1238 iiimageclass x mf1643i iiimageclass x mf1643if iii sensys lbp630c seriesi sensys mf650c seriesi sensys lbp230 series1238p ii1238pr iii sensys mf450 seriesi sensys mf550 series1238i ii1238if iiimagerunner 1643i iiimagerunner 1643if ii

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
9.8	CVSS 3.1	CRITICAL	—	—	cvelistV5

Weakness & attack patterns

CWE-787

Detection

Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.

Search application, proxy, and WAF logs for requests touching /Satera, /Color, /imageCLASS, /i-SENSYS, /1238P, /1238Pr, /1238i, /1238iF, /imageRUNNER.

References

4 on the record

psirt.canon/advisory-information/cp2026-001/
vendor-advisory
canon.jp/support/support-info/260115vulnerability-response
vendor-advisory
www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Remediation-Measure-Against-Potential-Buffer-Overflow-Vulnerability-in-Laser-Printers-and-Small-Office-Multifunctional-Printers
vendor-advisory
www.canon-europe.com/support/product-security/
vendor-advisory

Elsewhere on this site

canonevery CVE for this vendor
CWE-787other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.