CVE-2025-14235

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
Canon Inc.Satera LBP670C Series06.02 and earlier
Canon Inc.Satera MF750C Series06.02 and earlier
Canon Inc.Color imageCLASS LBP630C06.02 and earlier
Canon Inc.Color imageCLASS MF650C Series06.02 and earlier
Canon Inc.imageCLASS LBP230 Series06.02 and earlier
Canon Inc.imageCLASS X LBP1238 II06.02 and earlier
Canon Inc.imageCLASS MF450 Series06.02 and earlier
Canon Inc.imageCLASS X MF1238 II06.02 and earlier
Canon Inc.imageCLASS X MF1643i II06.02 and earlier
Canon Inc.imageCLASS X MF1643iF II06.02 and earlier
Canon Inc.i-SENSYS LBP630C Series06.02 and earlier
Canon Inc.i-SENSYS MF650C Series06.02 and earlier
Canon Inc.i-SENSYS LBP230 Series06.02 and earlier
Canon Inc.1238P II06.02 and earlier
Canon Inc.1238Pr II06.02 and earlier
Canon Inc.i-SENSYS MF450 Series06.02 and earlier
Canon Inc.i-SENSYS MF550 Series06.02 and earlier
Canon Inc.1238i II06.02 and earlier
Canon Inc.1238iF II06.02 and earlier
Canon Inc.imageRUNNER 1643i II06.02 and earlier
Canon Inc.imageRUNNER 1643iF II06.02 and earlier

References

Timeline

Published
Jan 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-142369.8Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the networCVE-2025-142379.8Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on theCVE-2025-14248.6A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical acceCVE-2025-142426.5A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing,CVE-2025-142435.3A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernameCVE-2025-142444.8A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomControlCVE-2025-142459.8A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such CVE-2025-142469.8A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settingsCVE-2025-142479.8A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/addiCVE-2025-142489.8A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The mCVE-2025-142499.8A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /usCVE-2025-14254.7A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the dev
CVE-2025-14235: Critical severity, CVSS 9.8 | Vulnix